{
  "type": "URL",
  "indicator": "https://chi.accordde.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://chi.accordde.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4160863289,
      "indicator": "https://chi.accordde.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6946fdbb4a22dc28d60d6ca2",
          "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
          "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
          "modified": "2026-01-19T19:04:41.997000",
          "created": "2025-12-20T19:49:15.713000",
          "tags": [
            "doomscroller",
            "browsehappy",
            "xpirat",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "united",
            "tlsv1",
            "execution",
            "dock",
            "write",
            "persistence",
            "encrypt",
            "meta",
            "browse happy",
            "worry",
            "body doctype",
            "online",
            "gmt server",
            "a domains",
            "ipv4 add",
            "win32",
            "trojandropper",
            "title",
            "date",
            "unknown",
            "post http",
            "cryptexportkey",
            "cryptgenkey",
            "calgrc4",
            "expiro",
            "temple",
            "xserver",
            "adversaries",
            "worry wordpress"
          ],
          "references": [
            "Xpirat = doomscroller.io"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Xpirat",
              "display_name": "Xpirat",
              "target": null
            },
            {
              "id": "Expiro",
              "display_name": "Expiro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            },
            {
              "id": "T1423",
              "name": "Network Service Scanning",
              "display_name": "T1423 - Network Service Scanning"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5576,
            "domain": 1502,
            "FileHash-MD5": 116,
            "FileHash-SHA1": 73,
            "FileHash-SHA256": 1041,
            "SSLCertFingerprint": 1,
            "hostname": 1951
          },
          "indicator_count": 10260,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6944ce38344ccded23df66f5",
          "name": "Ransom - Amnesty.org - a single link in a Pegasus attack against a civilian.",
          "description": "I don\u2019t have the right words to put this together because it involves so much coercion, fraud, betrayal, manipulation , hacking, multiple business fronts, loud mouth mafia plants, working with someone under false pretenses, redhat security teams in Denver , Colorado, false implications of cyber attacks coming from foreign entities. \n\nTips come from a highly reliable sources. One link in a Pegasus attack .",
          "modified": "2026-01-18T03:05:59.836000",
          "created": "2025-12-19T04:02:00.973000",
          "tags": [
            "intel",
            "ms windows",
            "write c",
            "pe32",
            "pe32 executable",
            "copy c",
            "free",
            "benjamin",
            "write",
            "worm",
            "win32",
            "code",
            "june",
            "delphi",
            "malware",
            "benjamin",
            "tulach",
            "state of colorado",
            "christopher p. \u2018buzz\u2019 ahmann",
            "danica implants",
            "nids_malware_alert",
            "bonu$",
            "network_icmp",
            "network_irc",
            "persistence_autorun",
            "network_http",
            "nids_alert",
            "allocates_rwx",
            "hackers",
            "creates_exe",
            "brian sabey",
            "sour del",
            "packer_entropy",
            "antivm_memory_available",
            "pe_features",
            "get key",
            "crime",
            "organized crime",
            "federal crime",
            "cyber crime",
            "piracy",
            "status",
            "china unknown",
            "name servers",
            "div div",
            "ip address",
            "domain",
            "creation date",
            "record value",
            "meta",
            "title",
            "hong kong",
            "passive dns",
            "gmt content",
            "type",
            "content length",
            "ipv4 add",
            "urls",
            "files",
            "location hong",
            "twitter",
            "youtube",
            "side 3 studios",
            "denver music",
            "infiltration",
            "whistleblower",
            "getkey",
            "cyber warfare",
            "fraud",
            "financial crimes",
            "pegasus",
            "music front",
            "france unknown",
            "present feb",
            "iran unknown",
            "present nov",
            "present jun",
            "present jan",
            "hidden",
            "present jul",
            "date",
            "united",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "llc name",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "show technique",
            "ck matrix",
            "ascii text",
            "href",
            "show process",
            "file",
            "general",
            "local",
            "path",
            "memory dumping",
            "entries",
            "icmp delphi",
            "showing",
            "delete",
            "yara detections",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "dns query",
            "packing t1045",
            "ransom",
            "cve",
            "palantir",
            "remote",
            "graham"
          ],
          "references": [
            "Amnesty.org | remote.amnesty.org",
            "tulach.cc",
            "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
            "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
            "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
            "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
            "Delphi This program must be run under Win32 Compilers",
            "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
            "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
            "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
            "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
            "ipv4bot.whatismyipaddress.com",
            "helloprismatic.com",
            "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
            "Brian Sabey",
            "Christopher P. \u2018Buzz\u2019 Ahmann"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "Ransom:Win32/GandCrab",
              "display_name": "Ransom:Win32/GandCrab",
              "target": "/malware/Ransom:Win32/GandCrab"
            },
            {
              "id": "CVE-2023-2868",
              "display_name": "CVE-2023-2868",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 429,
            "FileHash-SHA1": 341,
            "FileHash-SHA256": 2766,
            "URL": 6976,
            "domain": 1151,
            "CVE": 2,
            "email": 3,
            "hostname": 2913,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 14585,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "91 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693f5674439d297728312967",
          "name": "BeenVerified.com | Malicious Information Doman |",
          "description": "34.232.241.155:443 (segment.prod.bidr.io)\t GET\tsegment.prod.bidr.io/associate-segment?buzz_key=tatari&segment_key=tatari-983&value=&uncacheplz=9327084282",
          "modified": "2026-01-14T00:04:33.341000",
          "created": "2025-12-15T00:29:40.025000",
          "tags": [
            "united",
            "as13335",
            "as14061",
            "cname",
            "as20940",
            "date",
            "name",
            "status",
            "present dec",
            "present nov",
            "unknown",
            "body",
            "cluster",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "search",
            "read c",
            "show",
            "execution",
            "next",
            "dock",
            "write",
            "capture",
            "persistence",
            "local",
            "copy",
            "trojan",
            "win32",
            "mtb oct",
            "entries",
            "passive dns",
            "next associated",
            "msr feb",
            "gmt cache",
            "ipv4 add",
            "title",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "name servers",
            "creation date",
            "emails",
            "domain name",
            "expiration date",
            "servers",
            "error",
            "flag",
            "prefetch8",
            "prefetch1",
            "win64",
            "khtml",
            "gecko",
            "pcap frame",
            "microsoft edge",
            "strings",
            "show process",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "sha1",
            "network traffic",
            "ogoogle trust",
            "pattern match",
            "path",
            "hybrid",
            "cookie",
            "general",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "initial access",
            "spawns",
            "ssl certificate",
            "click"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1764,
            "FileHash-SHA256": 1006,
            "URL": 5427,
            "domain": 442,
            "email": 3,
            "FileHash-MD5": 115,
            "FileHash-SHA1": 62,
            "SSLCertFingerprint": 21
          },
          "indicator_count": 8840,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "95 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693f5675e3f12fa3229bdcb3",
          "name": "BeenVerified.com | Malicious Information Doman |",
          "description": "34.232.241.155:443 (segment.prod.bidr.io)\t GET\tsegment.prod.bidr.io/associate-segment?buzz_key=tatari&segment_key=tatari-983&value=&uncacheplz=9327084282",
          "modified": "2026-01-14T00:04:33.341000",
          "created": "2025-12-15T00:29:41.963000",
          "tags": [
            "united",
            "as13335",
            "as14061",
            "cname",
            "as20940",
            "date",
            "name",
            "status",
            "present dec",
            "present nov",
            "unknown",
            "body",
            "cluster",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "search",
            "read c",
            "show",
            "execution",
            "next",
            "dock",
            "write",
            "capture",
            "persistence",
            "local",
            "copy",
            "trojan",
            "win32",
            "mtb oct",
            "entries",
            "passive dns",
            "next associated",
            "msr feb",
            "gmt cache",
            "ipv4 add",
            "title",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "name servers",
            "creation date",
            "emails",
            "domain name",
            "expiration date",
            "servers",
            "error",
            "flag",
            "prefetch8",
            "prefetch1",
            "win64",
            "khtml",
            "gecko",
            "pcap frame",
            "microsoft edge",
            "strings",
            "show process",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "sha1",
            "network traffic",
            "ogoogle trust",
            "pattern match",
            "path",
            "hybrid",
            "cookie",
            "general",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "initial access",
            "spawns",
            "ssl certificate",
            "click"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1764,
            "FileHash-SHA256": 1006,
            "URL": 5427,
            "domain": 442,
            "email": 3,
            "FileHash-MD5": 115,
            "FileHash-SHA1": 62,
            "SSLCertFingerprint": 21
          },
          "indicator_count": 8840,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "95 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693f57720ddcc1a02d19a78f",
          "name": "GameHack Malware | BeenVerified.com | Information Doman |",
          "description": "",
          "modified": "2026-01-14T00:04:33.341000",
          "created": "2025-12-15T00:33:54.304000",
          "tags": [
            "united",
            "as13335",
            "as14061",
            "cname",
            "as20940",
            "date",
            "name",
            "status",
            "present dec",
            "present nov",
            "unknown",
            "body",
            "cluster",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "search",
            "read c",
            "show",
            "execution",
            "next",
            "dock",
            "write",
            "capture",
            "persistence",
            "local",
            "copy",
            "trojan",
            "win32",
            "mtb oct",
            "entries",
            "passive dns",
            "next associated",
            "msr feb",
            "gmt cache",
            "ipv4 add",
            "title",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "name servers",
            "creation date",
            "emails",
            "domain name",
            "expiration date",
            "servers",
            "error",
            "flag",
            "prefetch8",
            "prefetch1",
            "win64",
            "khtml",
            "gecko",
            "pcap frame",
            "microsoft edge",
            "strings",
            "show process",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "sha1",
            "network traffic",
            "ogoogle trust",
            "pattern match",
            "path",
            "hybrid",
            "cookie",
            "general",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "initial access",
            "spawns",
            "ssl certificate",
            "click"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "693f5674439d297728312967",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1764,
            "FileHash-SHA256": 1006,
            "URL": 5427,
            "domain": 442,
            "email": 3,
            "FileHash-MD5": 115,
            "FileHash-SHA1": 62,
            "SSLCertFingerprint": 21
          },
          "indicator_count": 8840,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "95 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693de4a8a72cf95b028365f0",
          "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee",
          "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets",
          "modified": "2026-01-12T21:02:35.560000",
          "created": "2025-12-13T22:11:52.474000",
          "tags": [
            "network",
            "ip address",
            "subnet",
            "dynamicloader",
            "port",
            "destination",
            "high",
            "windows",
            "united",
            "write",
            "tofsee",
            "stream",
            "win64",
            "push",
            "urls",
            "url analysis",
            "dnssec",
            "script domains",
            "encrypt",
            "url add",
            "http",
            "related nids",
            "flag united",
            "germany",
            "address google",
            "passive dns",
            "ipv4 add",
            "files",
            "asn as13335",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "location united",
            "asn asnone",
            "present dec",
            "backdoor",
            "lowfi",
            "win32autoit mar",
            "urls show",
            "date checked",
            "connection",
            "httponly",
            "secure",
            "path",
            "expiressat",
            "dynamic cfray",
            "medium",
            "delete c",
            "displayname",
            "show",
            "unknown",
            "next",
            "rndhex",
            "malware",
            "cname",
            "next associated",
            "url hostname",
            "server response",
            "google safe",
            "read c",
            "unicode",
            "png image",
            "rgba",
            "memcommit",
            "dock",
            "execution",
            "files location",
            "china flag",
            "china hostname",
            "hostname",
            "domain",
            "files ip",
            "address",
            "asn as45102",
            "gmt content",
            "certificate",
            "associated urls",
            "location china",
            "china asn",
            "as4808 china",
            "present aug",
            "object",
            "present apr",
            "present oct",
            "alman",
            "present sep",
            "error",
            "present jul",
            "rmndrp",
            "present feb",
            "expiration",
            "url https",
            "url http",
            "iocs",
            "review iocs",
            "expireswed",
            "samesitenone",
            "maxage86400",
            "maxage0",
            "server",
            "expires",
            "victina nulcac",
            "data upload",
            "extraction",
            "enter",
            "enter source",
            "url data",
            "type",
            "extract indic",
            "included iocs",
            "china unknown",
            "botnet",
            "folk in browser",
            "japan unknown",
            "asnone country",
            "as13335",
            "a domains",
            "script urls",
            "servers",
            "title",
            "moved",
            "record value",
            "entries",
            "whitelisted",
            "powershell",
            "xf9xb5xf9",
            "xxcexf6x8fr",
            "k2xe7xcbxxeaxa2",
            "x99x19",
            "x88yxf9xc858",
            "x83x12x8da",
            "zx9bx8ex84",
            "attempts",
            "yara detections",
            "contacted",
            "tags none",
            "file type",
            "pe packer",
            "dll compilation",
            "guard",
            "botnets"
          ],
          "references": [
            "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
            "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
            "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
            "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
            "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America",
            "Russian Federation",
            "T\u00fcrkiye",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Backdoor:Win32/Tofsee",
              "display_name": "Backdoor:Win32/Tofsee",
              "target": "/malware/Backdoor:Win32/Tofsee"
            },
            {
              "id": "AutoIT",
              "display_name": "AutoIT",
              "target": null
            },
            {
              "id": "HtBot",
              "display_name": "HtBot",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1195.001",
              "name": "Compromise Software Dependencies and Development Tools",
              "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1593.001",
              "name": "Social Media",
              "display_name": "T1593.001 - Social Media"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1481",
              "name": "Web Service",
              "display_name": "T1481 - Web Service"
            },
            {
              "id": "T1534",
              "name": "Internal Spearphishing",
              "display_name": "T1534 - Internal Spearphishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8145,
            "domain": 1389,
            "FileHash-SHA256": 1545,
            "CIDR": 2,
            "hostname": 2533,
            "FileHash-MD5": 209,
            "FileHash-SHA1": 190,
            "email": 6,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 14023,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "96 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693adba47b2cce69440c726a",
          "name": "TESLA HACKERS | Login Google",
          "description": "Attackers target victims Google account, Google browser, Google homepage.\n\nTesla Hackers in the job. Tesla hackers are very young , angry,  kids who chased target around mercilessly in their vehicles, photographed target, drive threateningly.  Nothing sophisticated about the stalker crewl. This is intentional. Finding troubled individuals who are desperate for power is pretty easy. \n\nThe hit men range from gang members, white , black , Hispanic to the highly educated, Hit man who attempted to take target out was a spoiled, angry , aggressive, sneering POC. He walked in Denver. The next morning , the area target was driven if roadway was closed off and filled with a rather large road crew, work continues to work on this area. (Charlie Kirk like). Alleged traffic officer claims cameras pointed in different directions that night. He was identified as a computer science major by a PI.  This feels so dangerous.",
          "modified": "2026-01-10T13:01:53.320000",
          "created": "2025-12-11T14:56:36.874000",
          "tags": [
            "tlsv1",
            "united",
            "oamazon",
            "cnamazon rsa",
            "jfif",
            "ogoogle trust",
            "cngts ca",
            "exif standard",
            "tiff image",
            "xresolution74",
            "execution",
            "dock",
            "write",
            "persistence",
            "malware",
            "encrypt",
            "ca https",
            "no expiration",
            "iocs",
            "url https",
            "enter source",
            "url or",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "ipv4",
            "url http",
            "type indicator",
            "sec ch",
            "ch ua",
            "unknown",
            "ua full",
            "ua platform",
            "as44273 host",
            "ua bitness",
            "msie",
            "chrome",
            "backdoor",
            "trojandropper",
            "passive dns",
            "forbidden",
            "body",
            "twitter",
            "trojan",
            "cookie",
            "title",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "port",
            "destination",
            "local",
            "moved",
            "integration all",
            "urls",
            "files",
            "reverse dns",
            "location united",
            "america flag",
            "name servers",
            "hostname",
            "unique",
            "expires wed",
            "gmt date",
            "server",
            "date wed",
            "connection",
            "use linux",
            "cybersecurity",
            "http",
            "ip address",
            "files location",
            "flag united",
            "win32",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "virtool",
            "date hash",
            "avast avg",
            "heur",
            "lowfi",
            "k sep",
            "contacted",
            "related tags",
            "none file",
            "type",
            "present dec",
            "present nov",
            "mtb mar",
            "aaaa",
            "hacktool",
            "indicator role",
            "domain",
            "url add",
            "as20940",
            "as16625 akamai",
            "present mar",
            "present may",
            "as54113",
            "present apr",
            "ipv4 add",
            "url analysis",
            "servers",
            "emails",
            "hostname add",
            "present aug",
            "present sep",
            "present oct",
            "status",
            "present jul",
            "data upload",
            "extraction",
            "as208722 yandex",
            "russia unknown",
            "a domains",
            "expirestue",
            "path",
            "certificate",
            "medium",
            "alerts show",
            "ck technique",
            "technique id",
            "installs",
            "pe32",
            "intel",
            "ms windows",
            "high",
            "icmp traffic",
            "dns query",
            "packing t1045",
            "t1045",
            "screenshots",
            "file type",
            "date february",
            "pm size",
            "imphash pehash",
            "guard",
            "syst",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "initial access",
            "spawns",
            "t1590 gather",
            "flag",
            "united kingdom",
            "command decode",
            "belgium belgium",
            "federation",
            "france france",
            "ireland ireland",
            "canada canada",
            "suricata ipv4",
            "click",
            "tesla hackers",
            "elon musk",
            "show",
            "richhash",
            "external",
            "virustotal api",
            "comments",
            "vendor finding",
            "notes clamav",
            "ms defender",
            "files matching",
            "copy",
            "found",
            "ssl certificate",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "yara rule",
            "reads",
            "number",
            "sample analysis",
            "hide samples",
            "entries",
            "samples show",
            "next yara",
            "detections name",
            "devcv5 ujrb",
            "ujrb",
            "uja1t",
            "show technique",
            "mitre att",
            "ck matrix",
            "ascii text",
            "pattern match",
            "sha1",
            "network traffic",
            "show process",
            "general"
          ],
          "references": [
            "https://www.teslarati.com/spacex",
            "https://omodeling.wpenginepowered.com/wp-content/uploads/2020/07/modelhub-pornhub-sell-nudes-1024x57",
            "https://cdn.teslarati.com \u2022  https://forums.teslarati.com/",
            "https://forums.teslarati.com/data/avatars/m/5/5998.jpg?1504431665 \u2022 https://forums.teslarati.com/forums/model-3.4/",
            "https://forums.teslarati.com/threads/humanlike-ai-robot-sophia-calls-out-elon-musk-during-live-interview.4970/",
            "https://www.teslarati.com/tesla-model-s-hitch-torklift-ecohitch-3-year-update/",
            "https://www.teslarati.com/tesla-tsla-monster-investment-rise-alaska-dept-of-revenue/",
            "https://www.teslarati.com/wp-content/themes/teslarati-mag/map/",
            "https://www.teslarati.com/tesla-model-3-crash-insight-60mph-collision/",
            "https://www.teslarati.com/",
            "https://www.teslarati.com/spacex",
            "https://www.teslarati.com/tesla-lands-87-million-megapack-belgium/",
            "https://www.teslarati.com/tesla-giga-shanghai-builds-5-millionth-battery-pack/",
            "https://www.teslarati.com/TESLA-DEBUTS-GROK-AI-UPDATE-2025-26-WHAT-YOU-NEED-TO-KNOW/",
            "https://www.teslarati.com/tesla-robotaxi-vs-new-york-taxi-why-the-yellow-cab-a-lot-to-lose/",
            "pornlynx.com \u2022 https://pornlynx.com \u2022 https://www.pornlynx",
            "http://www.aiupnow.com/2023/04/pakistani-hackers-use-linux-malware.html\\",
            "http://pickyhot.disqus.com/ \u2022 https://www.teslarati.com/tesla-hackers \u2022  https://pickyhot.disqus.com/tsara-brashears",
            "http://dev.browserweb.yandex.kg/ \u2022 https://api.messenger.yandex.az/ \u2022 https://yandex.uz/maps/-/CLWNeAKm",
            "HTML contains suspicious external redirect patterns details Suspicious redirect patterns detected:  Redirect Types: Delayed Redirect  Redirects to: /doodles/  Suspicious",
            "Redirect (Delayed Redirect): setTimeout(function(){location.href= source Binary File relevance 10/10 ATT&CK ID T1189",
            "External resources linked to high-risk commonly abused domains detected: mc.yandex.ru | script | src snd.click | src |",
            "Source :  Binary File  ATT&CK ID T1566.002",
            "Domain match: \"media-mbst-pub-ue1.s3.amazonaws.com\" possible high risk indicator. Commonly abused for malicious purposes. .",
            "Domain: \"snd.click\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes",
            "Detected Non-Google domain serving Google homepage details",
            "Detected Google homepage HTML served from suspicious domain Matched required Google homepage markers",
            "Source: Binary File relevance 10/10 ATT&CK ID T1204.001 | Target contacted CBI re: Suspicious looking Google Homepage.",
            "CBI (Colorado) - target believes she was redirected to malicious actors. Staffers not found in directory.",
            "Female states title as \u2018intern\u2019 dropped false information at front desk of CBI. Claims target ID theft victim. True",
            "Alleged CBI staffer refuses to provide evidence of identity theft resolution. Target unaware of. what\u2019s true",
            "CBI - asked target to enter Gmail in a resource. Targets Gmail account disappeared"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Ms Defender\tTrojan:Win32/Qbot.KVD!MTB",
              "display_name": "Ms Defender\tTrojan:Win32/Qbot.KVD!MTB",
              "target": "/malware/Ms Defender\tTrojan:Win32/Qbot.KVD!MTB"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Malware.Jaik-9940406-0",
              "display_name": "Win.Malware.Jaik-9940406-0",
              "target": null
            },
            {
              "id": "ALF:JASYP:Trojan:Win32/Genmaldown!atmn",
              "display_name": "ALF:JASYP:Trojan:Win32/Genmaldown!atmn",
              "target": null
            },
            {
              "id": "Win.Malware.Snojan-6775202-0",
              "display_name": "Win.Malware.Snojan-6775202-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1566.001",
              "name": "Spearphishing Attachment",
              "display_name": "T1566.001 - Spearphishing Attachment"
            },
            {
              "id": "T1207",
              "name": "Rogue Domain Controller",
              "display_name": "T1207 - Rogue Domain Controller"
            },
            {
              "id": "T1136.002",
              "name": "Domain Account",
              "display_name": "T1136.002 - Domain Account"
            },
            {
              "id": "T1003.005",
              "name": "Cached Domain Credentials",
              "display_name": "T1003.005 - Cached Domain Credentials"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5894,
            "FileHash-MD5": 458,
            "FileHash-SHA1": 305,
            "FileHash-SHA256": 2481,
            "SSLCertFingerprint": 26,
            "hostname": 2406,
            "domain": 966,
            "email": 16,
            "CVE": 1
          },
          "indicator_count": 12553,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "99 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "ipv4bot.whatismyipaddress.com",
        "Source :  Binary File  ATT&CK ID T1566.002",
        "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
        "https://www.teslarati.com/tesla-robotaxi-vs-new-york-taxi-why-the-yellow-cab-a-lot-to-lose/",
        "CBI - asked target to enter Gmail in a resource. Targets Gmail account disappeared",
        "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
        "HTML contains suspicious external redirect patterns details Suspicious redirect patterns detected:  Redirect Types: Delayed Redirect  Redirects to: /doodles/  Suspicious",
        "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
        "http://pickyhot.disqus.com/ \u2022 https://www.teslarati.com/tesla-hackers \u2022  https://pickyhot.disqus.com/tsara-brashears",
        "Redirect (Delayed Redirect): setTimeout(function(){location.href= source Binary File relevance 10/10 ATT&CK ID T1189",
        "Detected Google homepage HTML served from suspicious domain Matched required Google homepage markers",
        "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
        "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
        "helloprismatic.com",
        "https://www.teslarati.com/tesla-model-s-hitch-torklift-ecohitch-3-year-update/",
        "https://www.teslarati.com/spacex",
        "Domain: \"snd.click\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes",
        "pornlynx.com \u2022 https://pornlynx.com \u2022 https://www.pornlynx",
        "CBI (Colorado) - target believes she was redirected to malicious actors. Staffers not found in directory.",
        "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
        "https://www.teslarati.com/tesla-tsla-monster-investment-rise-alaska-dept-of-revenue/",
        "Detected Non-Google domain serving Google homepage details",
        "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com",
        "Source: Binary File relevance 10/10 ATT&CK ID T1204.001 | Target contacted CBI re: Suspicious looking Google Homepage.",
        "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
        "http://www.aiupnow.com/2023/04/pakistani-hackers-use-linux-malware.html\\",
        "External resources linked to high-risk commonly abused domains detected: mc.yandex.ru | script | src snd.click | src |",
        "Amnesty.org | remote.amnesty.org",
        "Female states title as \u2018intern\u2019 dropped false information at front desk of CBI. Claims target ID theft victim. True",
        "https://www.teslarati.com/tesla-giga-shanghai-builds-5-millionth-battery-pack/",
        "https://www.teslarati.com/wp-content/themes/teslarati-mag/map/",
        "https://cdn.teslarati.com \u2022  https://forums.teslarati.com/",
        "https://omodeling.wpenginepowered.com/wp-content/uploads/2020/07/modelhub-pornhub-sell-nudes-1024x57",
        "https://forums.teslarati.com/threads/humanlike-ai-robot-sophia-calls-out-elon-musk-during-live-interview.4970/",
        "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
        "http://dev.browserweb.yandex.kg/ \u2022 https://api.messenger.yandex.az/ \u2022 https://yandex.uz/maps/-/CLWNeAKm",
        "https://www.teslarati.com/",
        "Alleged CBI staffer refuses to provide evidence of identity theft resolution. Target unaware of. what\u2019s true",
        "Xpirat = doomscroller.io",
        "https://www.teslarati.com/tesla-model-3-crash-insight-60mph-collision/",
        "Christopher P. \u2018Buzz\u2019 Ahmann",
        "Brian Sabey",
        "https://www.teslarati.com/TESLA-DEBUTS-GROK-AI-UPDATE-2025-26-WHAT-YOU-NEED-TO-KNOW/",
        "tulach.cc",
        "Domain match: \"media-mbst-pub-ue1.s3.amazonaws.com\" possible high risk indicator. Commonly abused for malicious purposes. .",
        "https://forums.teslarati.com/data/avatars/m/5/5998.jpg?1504431665 \u2022 https://forums.teslarati.com/forums/model-3.4/",
        "https://www.teslarati.com/tesla-lands-87-million-megapack-belgium/",
        "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
        "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
        "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
        "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
        "Delphi This program must be run under Win32 Compilers",
        "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Ransom:win32/gandcrab",
            "Backdoor:win32/tofsee",
            "Worm:win32/benjamin",
            "Xpirat",
            "Worm:win32/mofksys.rnd!mtb",
            "Trojan:win32/zombie.a",
            "Win.malware.snojan-6775202-0",
            "Expiro",
            "Autoit",
            "Mirai",
            "Htbot",
            "Exploit:win32/cve-2017-0147",
            "Ms defender\ttrojan:win32/qbot.kvd!mtb",
            "Alf:jasyp:trojan:win32/genmaldown!atmn",
            "Win.malware.jaik-9940406-0",
            "Cve-2023-2868"
          ],
          "industries": [],
          "unique_indicators": 56520
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/accordde.com",
    "whois": "http://whois.domaintools.com/accordde.com",
    "domain": "accordde.com",
    "hostname": "chi.accordde.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6946fdbb4a22dc28d60d6ca2",
      "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
      "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
      "modified": "2026-01-19T19:04:41.997000",
      "created": "2025-12-20T19:49:15.713000",
      "tags": [
        "doomscroller",
        "browsehappy",
        "xpirat",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "united",
        "tlsv1",
        "execution",
        "dock",
        "write",
        "persistence",
        "encrypt",
        "meta",
        "browse happy",
        "worry",
        "body doctype",
        "online",
        "gmt server",
        "a domains",
        "ipv4 add",
        "win32",
        "trojandropper",
        "title",
        "date",
        "unknown",
        "post http",
        "cryptexportkey",
        "cryptgenkey",
        "calgrc4",
        "expiro",
        "temple",
        "xserver",
        "adversaries",
        "worry wordpress"
      ],
      "references": [
        "Xpirat = doomscroller.io"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Xpirat",
          "display_name": "Xpirat",
          "target": null
        },
        {
          "id": "Expiro",
          "display_name": "Expiro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        },
        {
          "id": "T1423",
          "name": "Network Service Scanning",
          "display_name": "T1423 - Network Service Scanning"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5576,
        "domain": 1502,
        "FileHash-MD5": 116,
        "FileHash-SHA1": 73,
        "FileHash-SHA256": 1041,
        "SSLCertFingerprint": 1,
        "hostname": 1951
      },
      "indicator_count": 10260,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6944ce38344ccded23df66f5",
      "name": "Ransom - Amnesty.org - a single link in a Pegasus attack against a civilian.",
      "description": "I don\u2019t have the right words to put this together because it involves so much coercion, fraud, betrayal, manipulation , hacking, multiple business fronts, loud mouth mafia plants, working with someone under false pretenses, redhat security teams in Denver , Colorado, false implications of cyber attacks coming from foreign entities. \n\nTips come from a highly reliable sources. One link in a Pegasus attack .",
      "modified": "2026-01-18T03:05:59.836000",
      "created": "2025-12-19T04:02:00.973000",
      "tags": [
        "intel",
        "ms windows",
        "write c",
        "pe32",
        "pe32 executable",
        "copy c",
        "free",
        "benjamin",
        "write",
        "worm",
        "win32",
        "code",
        "june",
        "delphi",
        "malware",
        "benjamin",
        "tulach",
        "state of colorado",
        "christopher p. \u2018buzz\u2019 ahmann",
        "danica implants",
        "nids_malware_alert",
        "bonu$",
        "network_icmp",
        "network_irc",
        "persistence_autorun",
        "network_http",
        "nids_alert",
        "allocates_rwx",
        "hackers",
        "creates_exe",
        "brian sabey",
        "sour del",
        "packer_entropy",
        "antivm_memory_available",
        "pe_features",
        "get key",
        "crime",
        "organized crime",
        "federal crime",
        "cyber crime",
        "piracy",
        "status",
        "china unknown",
        "name servers",
        "div div",
        "ip address",
        "domain",
        "creation date",
        "record value",
        "meta",
        "title",
        "hong kong",
        "passive dns",
        "gmt content",
        "type",
        "content length",
        "ipv4 add",
        "urls",
        "files",
        "location hong",
        "twitter",
        "youtube",
        "side 3 studios",
        "denver music",
        "infiltration",
        "whistleblower",
        "getkey",
        "cyber warfare",
        "fraud",
        "financial crimes",
        "pegasus",
        "music front",
        "france unknown",
        "present feb",
        "iran unknown",
        "present nov",
        "present jun",
        "present jan",
        "hidden",
        "present jul",
        "date",
        "united",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "llc name",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "show technique",
        "ck matrix",
        "ascii text",
        "href",
        "show process",
        "file",
        "general",
        "local",
        "path",
        "memory dumping",
        "entries",
        "icmp delphi",
        "showing",
        "delete",
        "yara detections",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "dns query",
        "packing t1045",
        "ransom",
        "cve",
        "palantir",
        "remote",
        "graham"
      ],
      "references": [
        "Amnesty.org | remote.amnesty.org",
        "tulach.cc",
        "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
        "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
        "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
        "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
        "Delphi This program must be run under Win32 Compilers",
        "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
        "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
        "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
        "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
        "ipv4bot.whatismyipaddress.com",
        "helloprismatic.com",
        "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
        "Brian Sabey",
        "Christopher P. \u2018Buzz\u2019 Ahmann"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "Ransom:Win32/GandCrab",
          "display_name": "Ransom:Win32/GandCrab",
          "target": "/malware/Ransom:Win32/GandCrab"
        },
        {
          "id": "CVE-2023-2868",
          "display_name": "CVE-2023-2868",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 429,
        "FileHash-SHA1": 341,
        "FileHash-SHA256": 2766,
        "URL": 6976,
        "domain": 1151,
        "CVE": 2,
        "email": 3,
        "hostname": 2913,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 14585,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "91 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693f5674439d297728312967",
      "name": "BeenVerified.com | Malicious Information Doman |",
      "description": "34.232.241.155:443 (segment.prod.bidr.io)\t GET\tsegment.prod.bidr.io/associate-segment?buzz_key=tatari&segment_key=tatari-983&value=&uncacheplz=9327084282",
      "modified": "2026-01-14T00:04:33.341000",
      "created": "2025-12-15T00:29:40.025000",
      "tags": [
        "united",
        "as13335",
        "as14061",
        "cname",
        "as20940",
        "date",
        "name",
        "status",
        "present dec",
        "present nov",
        "unknown",
        "body",
        "cluster",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "search",
        "read c",
        "show",
        "execution",
        "next",
        "dock",
        "write",
        "capture",
        "persistence",
        "local",
        "copy",
        "trojan",
        "win32",
        "mtb oct",
        "entries",
        "passive dns",
        "next associated",
        "msr feb",
        "gmt cache",
        "ipv4 add",
        "title",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "name servers",
        "creation date",
        "emails",
        "domain name",
        "expiration date",
        "servers",
        "error",
        "flag",
        "prefetch8",
        "prefetch1",
        "win64",
        "khtml",
        "gecko",
        "pcap frame",
        "microsoft edge",
        "strings",
        "show process",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "sha1",
        "network traffic",
        "ogoogle trust",
        "pattern match",
        "path",
        "hybrid",
        "cookie",
        "general",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "initial access",
        "spawns",
        "ssl certificate",
        "click"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1764,
        "FileHash-SHA256": 1006,
        "URL": 5427,
        "domain": 442,
        "email": 3,
        "FileHash-MD5": 115,
        "FileHash-SHA1": 62,
        "SSLCertFingerprint": 21
      },
      "indicator_count": 8840,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "95 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693f5675e3f12fa3229bdcb3",
      "name": "BeenVerified.com | Malicious Information Doman |",
      "description": "34.232.241.155:443 (segment.prod.bidr.io)\t GET\tsegment.prod.bidr.io/associate-segment?buzz_key=tatari&segment_key=tatari-983&value=&uncacheplz=9327084282",
      "modified": "2026-01-14T00:04:33.341000",
      "created": "2025-12-15T00:29:41.963000",
      "tags": [
        "united",
        "as13335",
        "as14061",
        "cname",
        "as20940",
        "date",
        "name",
        "status",
        "present dec",
        "present nov",
        "unknown",
        "body",
        "cluster",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "search",
        "read c",
        "show",
        "execution",
        "next",
        "dock",
        "write",
        "capture",
        "persistence",
        "local",
        "copy",
        "trojan",
        "win32",
        "mtb oct",
        "entries",
        "passive dns",
        "next associated",
        "msr feb",
        "gmt cache",
        "ipv4 add",
        "title",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "name servers",
        "creation date",
        "emails",
        "domain name",
        "expiration date",
        "servers",
        "error",
        "flag",
        "prefetch8",
        "prefetch1",
        "win64",
        "khtml",
        "gecko",
        "pcap frame",
        "microsoft edge",
        "strings",
        "show process",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "sha1",
        "network traffic",
        "ogoogle trust",
        "pattern match",
        "path",
        "hybrid",
        "cookie",
        "general",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "initial access",
        "spawns",
        "ssl certificate",
        "click"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1764,
        "FileHash-SHA256": 1006,
        "URL": 5427,
        "domain": 442,
        "email": 3,
        "FileHash-MD5": 115,
        "FileHash-SHA1": 62,
        "SSLCertFingerprint": 21
      },
      "indicator_count": 8840,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "95 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693f57720ddcc1a02d19a78f",
      "name": "GameHack Malware | BeenVerified.com | Information Doman |",
      "description": "",
      "modified": "2026-01-14T00:04:33.341000",
      "created": "2025-12-15T00:33:54.304000",
      "tags": [
        "united",
        "as13335",
        "as14061",
        "cname",
        "as20940",
        "date",
        "name",
        "status",
        "present dec",
        "present nov",
        "unknown",
        "body",
        "cluster",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "search",
        "read c",
        "show",
        "execution",
        "next",
        "dock",
        "write",
        "capture",
        "persistence",
        "local",
        "copy",
        "trojan",
        "win32",
        "mtb oct",
        "entries",
        "passive dns",
        "next associated",
        "msr feb",
        "gmt cache",
        "ipv4 add",
        "title",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "name servers",
        "creation date",
        "emails",
        "domain name",
        "expiration date",
        "servers",
        "error",
        "flag",
        "prefetch8",
        "prefetch1",
        "win64",
        "khtml",
        "gecko",
        "pcap frame",
        "microsoft edge",
        "strings",
        "show process",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "sha1",
        "network traffic",
        "ogoogle trust",
        "pattern match",
        "path",
        "hybrid",
        "cookie",
        "general",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "initial access",
        "spawns",
        "ssl certificate",
        "click"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "693f5674439d297728312967",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1764,
        "FileHash-SHA256": 1006,
        "URL": 5427,
        "domain": 442,
        "email": 3,
        "FileHash-MD5": 115,
        "FileHash-SHA1": 62,
        "SSLCertFingerprint": 21
      },
      "indicator_count": 8840,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "95 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693de4a8a72cf95b028365f0",
      "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee",
      "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets",
      "modified": "2026-01-12T21:02:35.560000",
      "created": "2025-12-13T22:11:52.474000",
      "tags": [
        "network",
        "ip address",
        "subnet",
        "dynamicloader",
        "port",
        "destination",
        "high",
        "windows",
        "united",
        "write",
        "tofsee",
        "stream",
        "win64",
        "push",
        "urls",
        "url analysis",
        "dnssec",
        "script domains",
        "encrypt",
        "url add",
        "http",
        "related nids",
        "flag united",
        "germany",
        "address google",
        "passive dns",
        "ipv4 add",
        "files",
        "asn as13335",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "location united",
        "asn asnone",
        "present dec",
        "backdoor",
        "lowfi",
        "win32autoit mar",
        "urls show",
        "date checked",
        "connection",
        "httponly",
        "secure",
        "path",
        "expiressat",
        "dynamic cfray",
        "medium",
        "delete c",
        "displayname",
        "show",
        "unknown",
        "next",
        "rndhex",
        "malware",
        "cname",
        "next associated",
        "url hostname",
        "server response",
        "google safe",
        "read c",
        "unicode",
        "png image",
        "rgba",
        "memcommit",
        "dock",
        "execution",
        "files location",
        "china flag",
        "china hostname",
        "hostname",
        "domain",
        "files ip",
        "address",
        "asn as45102",
        "gmt content",
        "certificate",
        "associated urls",
        "location china",
        "china asn",
        "as4808 china",
        "present aug",
        "object",
        "present apr",
        "present oct",
        "alman",
        "present sep",
        "error",
        "present jul",
        "rmndrp",
        "present feb",
        "expiration",
        "url https",
        "url http",
        "iocs",
        "review iocs",
        "expireswed",
        "samesitenone",
        "maxage86400",
        "maxage0",
        "server",
        "expires",
        "victina nulcac",
        "data upload",
        "extraction",
        "enter",
        "enter source",
        "url data",
        "type",
        "extract indic",
        "included iocs",
        "china unknown",
        "botnet",
        "folk in browser",
        "japan unknown",
        "asnone country",
        "as13335",
        "a domains",
        "script urls",
        "servers",
        "title",
        "moved",
        "record value",
        "entries",
        "whitelisted",
        "powershell",
        "xf9xb5xf9",
        "xxcexf6x8fr",
        "k2xe7xcbxxeaxa2",
        "x99x19",
        "x88yxf9xc858",
        "x83x12x8da",
        "zx9bx8ex84",
        "attempts",
        "yara detections",
        "contacted",
        "tags none",
        "file type",
        "pe packer",
        "dll compilation",
        "guard",
        "botnets"
      ],
      "references": [
        "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
        "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
        "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
        "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
        "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America",
        "Russian Federation",
        "T\u00fcrkiye",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Backdoor:Win32/Tofsee",
          "display_name": "Backdoor:Win32/Tofsee",
          "target": "/malware/Backdoor:Win32/Tofsee"
        },
        {
          "id": "AutoIT",
          "display_name": "AutoIT",
          "target": null
        },
        {
          "id": "HtBot",
          "display_name": "HtBot",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1195.001",
          "name": "Compromise Software Dependencies and Development Tools",
          "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1593.001",
          "name": "Social Media",
          "display_name": "T1593.001 - Social Media"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1481",
          "name": "Web Service",
          "display_name": "T1481 - Web Service"
        },
        {
          "id": "T1534",
          "name": "Internal Spearphishing",
          "display_name": "T1534 - Internal Spearphishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8145,
        "domain": 1389,
        "FileHash-SHA256": 1545,
        "CIDR": 2,
        "hostname": 2533,
        "FileHash-MD5": 209,
        "FileHash-SHA1": 190,
        "email": 6,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 14023,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "96 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693adba47b2cce69440c726a",
      "name": "TESLA HACKERS | Login Google",
      "description": "Attackers target victims Google account, Google browser, Google homepage.\n\nTesla Hackers in the job. Tesla hackers are very young , angry,  kids who chased target around mercilessly in their vehicles, photographed target, drive threateningly.  Nothing sophisticated about the stalker crewl. This is intentional. Finding troubled individuals who are desperate for power is pretty easy. \n\nThe hit men range from gang members, white , black , Hispanic to the highly educated, Hit man who attempted to take target out was a spoiled, angry , aggressive, sneering POC. He walked in Denver. The next morning , the area target was driven if roadway was closed off and filled with a rather large road crew, work continues to work on this area. (Charlie Kirk like). Alleged traffic officer claims cameras pointed in different directions that night. He was identified as a computer science major by a PI.  This feels so dangerous.",
      "modified": "2026-01-10T13:01:53.320000",
      "created": "2025-12-11T14:56:36.874000",
      "tags": [
        "tlsv1",
        "united",
        "oamazon",
        "cnamazon rsa",
        "jfif",
        "ogoogle trust",
        "cngts ca",
        "exif standard",
        "tiff image",
        "xresolution74",
        "execution",
        "dock",
        "write",
        "persistence",
        "malware",
        "encrypt",
        "ca https",
        "no expiration",
        "iocs",
        "url https",
        "enter source",
        "url or",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "ipv4",
        "url http",
        "type indicator",
        "sec ch",
        "ch ua",
        "unknown",
        "ua full",
        "ua platform",
        "as44273 host",
        "ua bitness",
        "msie",
        "chrome",
        "backdoor",
        "trojandropper",
        "passive dns",
        "forbidden",
        "body",
        "twitter",
        "trojan",
        "cookie",
        "title",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "port",
        "destination",
        "local",
        "moved",
        "integration all",
        "urls",
        "files",
        "reverse dns",
        "location united",
        "america flag",
        "name servers",
        "hostname",
        "unique",
        "expires wed",
        "gmt date",
        "server",
        "date wed",
        "connection",
        "use linux",
        "cybersecurity",
        "http",
        "ip address",
        "files location",
        "flag united",
        "win32",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "virtool",
        "date hash",
        "avast avg",
        "heur",
        "lowfi",
        "k sep",
        "contacted",
        "related tags",
        "none file",
        "type",
        "present dec",
        "present nov",
        "mtb mar",
        "aaaa",
        "hacktool",
        "indicator role",
        "domain",
        "url add",
        "as20940",
        "as16625 akamai",
        "present mar",
        "present may",
        "as54113",
        "present apr",
        "ipv4 add",
        "url analysis",
        "servers",
        "emails",
        "hostname add",
        "present aug",
        "present sep",
        "present oct",
        "status",
        "present jul",
        "data upload",
        "extraction",
        "as208722 yandex",
        "russia unknown",
        "a domains",
        "expirestue",
        "path",
        "certificate",
        "medium",
        "alerts show",
        "ck technique",
        "technique id",
        "installs",
        "pe32",
        "intel",
        "ms windows",
        "high",
        "icmp traffic",
        "dns query",
        "packing t1045",
        "t1045",
        "screenshots",
        "file type",
        "date february",
        "pm size",
        "imphash pehash",
        "guard",
        "syst",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "initial access",
        "spawns",
        "t1590 gather",
        "flag",
        "united kingdom",
        "command decode",
        "belgium belgium",
        "federation",
        "france france",
        "ireland ireland",
        "canada canada",
        "suricata ipv4",
        "click",
        "tesla hackers",
        "elon musk",
        "show",
        "richhash",
        "external",
        "virustotal api",
        "comments",
        "vendor finding",
        "notes clamav",
        "ms defender",
        "files matching",
        "copy",
        "found",
        "ssl certificate",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "yara rule",
        "reads",
        "number",
        "sample analysis",
        "hide samples",
        "entries",
        "samples show",
        "next yara",
        "detections name",
        "devcv5 ujrb",
        "ujrb",
        "uja1t",
        "show technique",
        "mitre att",
        "ck matrix",
        "ascii text",
        "pattern match",
        "sha1",
        "network traffic",
        "show process",
        "general"
      ],
      "references": [
        "https://www.teslarati.com/spacex",
        "https://omodeling.wpenginepowered.com/wp-content/uploads/2020/07/modelhub-pornhub-sell-nudes-1024x57",
        "https://cdn.teslarati.com \u2022  https://forums.teslarati.com/",
        "https://forums.teslarati.com/data/avatars/m/5/5998.jpg?1504431665 \u2022 https://forums.teslarati.com/forums/model-3.4/",
        "https://forums.teslarati.com/threads/humanlike-ai-robot-sophia-calls-out-elon-musk-during-live-interview.4970/",
        "https://www.teslarati.com/tesla-model-s-hitch-torklift-ecohitch-3-year-update/",
        "https://www.teslarati.com/tesla-tsla-monster-investment-rise-alaska-dept-of-revenue/",
        "https://www.teslarati.com/wp-content/themes/teslarati-mag/map/",
        "https://www.teslarati.com/tesla-model-3-crash-insight-60mph-collision/",
        "https://www.teslarati.com/",
        "https://www.teslarati.com/spacex",
        "https://www.teslarati.com/tesla-lands-87-million-megapack-belgium/",
        "https://www.teslarati.com/tesla-giga-shanghai-builds-5-millionth-battery-pack/",
        "https://www.teslarati.com/TESLA-DEBUTS-GROK-AI-UPDATE-2025-26-WHAT-YOU-NEED-TO-KNOW/",
        "https://www.teslarati.com/tesla-robotaxi-vs-new-york-taxi-why-the-yellow-cab-a-lot-to-lose/",
        "pornlynx.com \u2022 https://pornlynx.com \u2022 https://www.pornlynx",
        "http://www.aiupnow.com/2023/04/pakistani-hackers-use-linux-malware.html\\",
        "http://pickyhot.disqus.com/ \u2022 https://www.teslarati.com/tesla-hackers \u2022  https://pickyhot.disqus.com/tsara-brashears",
        "http://dev.browserweb.yandex.kg/ \u2022 https://api.messenger.yandex.az/ \u2022 https://yandex.uz/maps/-/CLWNeAKm",
        "HTML contains suspicious external redirect patterns details Suspicious redirect patterns detected:  Redirect Types: Delayed Redirect  Redirects to: /doodles/  Suspicious",
        "Redirect (Delayed Redirect): setTimeout(function(){location.href= source Binary File relevance 10/10 ATT&CK ID T1189",
        "External resources linked to high-risk commonly abused domains detected: mc.yandex.ru | script | src snd.click | src |",
        "Source :  Binary File  ATT&CK ID T1566.002",
        "Domain match: \"media-mbst-pub-ue1.s3.amazonaws.com\" possible high risk indicator. Commonly abused for malicious purposes. .",
        "Domain: \"snd.click\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes",
        "Detected Non-Google domain serving Google homepage details",
        "Detected Google homepage HTML served from suspicious domain Matched required Google homepage markers",
        "Source: Binary File relevance 10/10 ATT&CK ID T1204.001 | Target contacted CBI re: Suspicious looking Google Homepage.",
        "CBI (Colorado) - target believes she was redirected to malicious actors. Staffers not found in directory.",
        "Female states title as \u2018intern\u2019 dropped false information at front desk of CBI. Claims target ID theft victim. True",
        "Alleged CBI staffer refuses to provide evidence of identity theft resolution. Target unaware of. what\u2019s true",
        "CBI - asked target to enter Gmail in a resource. Targets Gmail account disappeared"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Ms Defender\tTrojan:Win32/Qbot.KVD!MTB",
          "display_name": "Ms Defender\tTrojan:Win32/Qbot.KVD!MTB",
          "target": "/malware/Ms Defender\tTrojan:Win32/Qbot.KVD!MTB"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Malware.Jaik-9940406-0",
          "display_name": "Win.Malware.Jaik-9940406-0",
          "target": null
        },
        {
          "id": "ALF:JASYP:Trojan:Win32/Genmaldown!atmn",
          "display_name": "ALF:JASYP:Trojan:Win32/Genmaldown!atmn",
          "target": null
        },
        {
          "id": "Win.Malware.Snojan-6775202-0",
          "display_name": "Win.Malware.Snojan-6775202-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1566.001",
          "name": "Spearphishing Attachment",
          "display_name": "T1566.001 - Spearphishing Attachment"
        },
        {
          "id": "T1207",
          "name": "Rogue Domain Controller",
          "display_name": "T1207 - Rogue Domain Controller"
        },
        {
          "id": "T1136.002",
          "name": "Domain Account",
          "display_name": "T1136.002 - Domain Account"
        },
        {
          "id": "T1003.005",
          "name": "Cached Domain Credentials",
          "display_name": "T1003.005 - Cached Domain Credentials"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5894,
        "FileHash-MD5": 458,
        "FileHash-SHA1": 305,
        "FileHash-SHA256": 2481,
        "SSLCertFingerprint": 26,
        "hostname": 2406,
        "domain": 966,
        "email": 16,
        "CVE": 1
      },
      "indicator_count": 12553,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "99 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://chi.accordde.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://chi.accordde.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776618312.6170585
}