{
  "type": "URL",
  "indicator": "https://controller.prod.hypershield.engineering/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://controller.prod.hypershield.engineering/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4142066540,
      "indicator": "https://controller.prod.hypershield.engineering/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "68fbc84609098d17c316f23c",
          "name": "NSO - Multiple crimes",
          "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-24T18:41:10.936000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "147 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fc18514965ccd3b55c216d",
          "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
          "description": "",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-25T00:22:41.686000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68fbc84609098d17c316f23c",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "147 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f9a1ef2dd26ec62a3c298c",
          "name": "Listeners - Malicious Over the top espionage | Cyber Warfare?",
          "description": "Cyber attacks on targeted devices stored safely, separately, don\u2019t communicate with one another. PalantirFoundry.com shares IP addresses with Fastly. South African IP\u2019s and DGA domains bounce from US Denver , Co based IP and Domain addresses. Registrar Abuse: HTTP/2 404 content type: text/html content length: 2263 date: Wed 22 Oct 2025 22:32:18 GMT server: Envoy\n443 Certificate Subject: US\n443 Certificate Subject: Colorado\n443 Certificate Subject: Denver\n443 Certificate Subject: Palantir Technologies Inc.\n443 Certificate Subject: listeners.usw-19.palantirfoundry.com",
          "modified": "2025-11-22T00:01:42.464000",
          "created": "2025-10-23T03:33:03.315000",
          "tags": [
            "url https",
            "url http",
            "hostname",
            "mulweli",
            "mphomafmulweli",
            "indicator role",
            "ipv4",
            "type indicator",
            "added active",
            "related pulses",
            "united",
            "envoy error",
            "certificate",
            "urls",
            "emails",
            "active related",
            "africa",
            "span",
            "gmt server",
            "colorado",
            "denver",
            "palantir",
            "listen",
            "listen linda",
            "linda listen",
            "listeners @ dantesdragon",
            "palantir",
            "all y",
            "se referen",
            "data upload",
            "extraction",
            "extra",
            "referen data",
            "overview domain",
            "passive dns",
            "files ip",
            "address",
            "asn asnone",
            "as14618",
            "all se",
            "include review",
            "exclude sugges",
            "failed",
            "typo",
            "status",
            "search",
            "record value",
            "server",
            "domain status",
            "key identifier",
            "x509v3 subject",
            "full name",
            "registrar abuse",
            "registrar",
            "data",
            "v3 serial",
            "code",
            "number",
            "cus odigicert",
            "inc cndigicert",
            "global g2",
            "tls rsa",
            "sha256",
            "united states",
            "power query",
            "microsoft learn",
            "ordenar por",
            "foundry",
            "input",
            "blocked",
            "error id",
            "conector",
            "por ejemplo",
            "sensitive",
            "quickstart",
            "present aug",
            "present oct",
            "unknown ns",
            "showing",
            "present sep",
            "moved",
            "title",
            "files",
            "reverse dns",
            "location united",
            "america flag",
            "america asn",
            "asnone dns",
            "resolutions",
            "dga domain",
            "ipv4 add",
            "url analysis",
            "name servers",
            "div div",
            "expiration date",
            "page",
            "present nov",
            "present jan",
            "present dec",
            "present mar",
            "present feb",
            "virtool",
            "cryp",
            "error",
            "win32",
            "domain",
            "ip address",
            "domain add",
            "next associated",
            "pulse pulses",
            "ashburn",
            "extr referen",
            "exclude",
            "sugges",
            "pulse submit",
            "date",
            "present jul",
            "present jun",
            "fastly error",
            "please",
            "handle",
            "entity",
            "record type",
            "ttl value",
            "msms93992282",
            "read c",
            "show",
            "medium",
            "tlsv1",
            "whitelisted",
            "module load",
            "t1129",
            "execution",
            "dock",
            "write",
            "persistence",
            "next",
            "unknown",
            "connector",
            "cybercrime",
            "harassment"
          ],
          "references": [
            "Products are being abused. Users are over zealous at blocking targets from basic human rights and privacy."
          ],
          "public": 1,
          "adversary": "Quickstart",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Multiple Malware Attack",
              "display_name": "Multiple Malware Attack",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1027.005",
              "name": "Indicator Removal from Tools",
              "display_name": "T1027.005 - Indicator Removal from Tools"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1132.002",
              "name": "Non-Standard Encoding",
              "display_name": "T1132.002 - Non-Standard Encoding"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [
            "Technology",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2865,
            "URL": 5728,
            "email": 11,
            "FileHash-MD5": 91,
            "FileHash-SHA1": 75,
            "FileHash-SHA256": 1713,
            "domain": 1193,
            "CVE": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 11679,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 180,
          "modified_text": "148 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f9a6f4e35193c04401daaf",
          "name": "Emotet & VirTool Obsfuscator - Registrar abuse tracking civilians",
          "description": "",
          "modified": "2025-11-22T00:01:42.464000",
          "created": "2025-10-23T03:54:28.671000",
          "tags": [
            "url https",
            "url http",
            "hostname",
            "mulweli",
            "mphomafmulweli",
            "indicator role",
            "ipv4",
            "type indicator",
            "added active",
            "related pulses",
            "united",
            "envoy error",
            "certificate",
            "urls",
            "emails",
            "active related",
            "africa",
            "span",
            "gmt server",
            "colorado",
            "denver",
            "palantir",
            "listen",
            "listen linda",
            "linda listen",
            "listeners @ dantesdragon",
            "palantir",
            "all y",
            "se referen",
            "data upload",
            "extraction",
            "extra",
            "referen data",
            "overview domain",
            "passive dns",
            "files ip",
            "address",
            "asn asnone",
            "as14618",
            "all se",
            "include review",
            "exclude sugges",
            "failed",
            "typo",
            "status",
            "search",
            "record value",
            "server",
            "domain status",
            "key identifier",
            "x509v3 subject",
            "full name",
            "registrar abuse",
            "registrar",
            "data",
            "v3 serial",
            "code",
            "number",
            "cus odigicert",
            "inc cndigicert",
            "global g2",
            "tls rsa",
            "sha256",
            "united states",
            "power query",
            "microsoft learn",
            "ordenar por",
            "foundry",
            "input",
            "blocked",
            "error id",
            "conector",
            "por ejemplo",
            "sensitive",
            "quickstart",
            "present aug",
            "present oct",
            "unknown ns",
            "showing",
            "present sep",
            "moved",
            "title",
            "files",
            "reverse dns",
            "location united",
            "america flag",
            "america asn",
            "asnone dns",
            "resolutions",
            "dga domain",
            "ipv4 add",
            "url analysis",
            "name servers",
            "div div",
            "expiration date",
            "page",
            "present nov",
            "present jan",
            "present dec",
            "present mar",
            "present feb",
            "virtool",
            "cryp",
            "error",
            "win32",
            "domain",
            "ip address",
            "domain add",
            "next associated",
            "pulse pulses",
            "ashburn",
            "extr referen",
            "exclude",
            "sugges",
            "pulse submit",
            "date",
            "present jul",
            "present jun",
            "fastly error",
            "please",
            "handle",
            "entity",
            "record type",
            "ttl value",
            "msms93992282",
            "read c",
            "show",
            "medium",
            "tlsv1",
            "whitelisted",
            "module load",
            "t1129",
            "execution",
            "dock",
            "write",
            "persistence",
            "next",
            "unknown",
            "connector",
            "cybercrime",
            "harassment"
          ],
          "references": [
            "Products are being abused. Users are over zealous at blocking targets from basic human rights and privacy."
          ],
          "public": 1,
          "adversary": "Quickstart",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Multiple Malware Attack",
              "display_name": "Multiple Malware Attack",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1027.005",
              "name": "Indicator Removal from Tools",
              "display_name": "T1027.005 - Indicator Removal from Tools"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1132.002",
              "name": "Non-Standard Encoding",
              "display_name": "T1132.002 - Non-Standard Encoding"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [
            "Technology",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": "68f9a1ef2dd26ec62a3c298c",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2865,
            "URL": 5728,
            "email": 11,
            "FileHash-MD5": 91,
            "FileHash-SHA1": 75,
            "FileHash-SHA256": 1713,
            "domain": 1193,
            "CVE": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 11679,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "148 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69069167e1e2a222bd7762f2",
          "name": "Palantir - Spyware",
          "description": "",
          "modified": "2025-11-22T00:01:42.464000",
          "created": "2025-11-01T23:01:59.339000",
          "tags": [
            "url https",
            "url http",
            "hostname",
            "mulweli",
            "mphomafmulweli",
            "indicator role",
            "ipv4",
            "type indicator",
            "added active",
            "related pulses",
            "united",
            "envoy error",
            "certificate",
            "urls",
            "emails",
            "active related",
            "africa",
            "span",
            "gmt server",
            "colorado",
            "denver",
            "palantir",
            "listen",
            "listen linda",
            "linda listen",
            "listeners @ dantesdragon",
            "palantir",
            "all y",
            "se referen",
            "data upload",
            "extraction",
            "extra",
            "referen data",
            "overview domain",
            "passive dns",
            "files ip",
            "address",
            "asn asnone",
            "as14618",
            "all se",
            "include review",
            "exclude sugges",
            "failed",
            "typo",
            "status",
            "search",
            "record value",
            "server",
            "domain status",
            "key identifier",
            "x509v3 subject",
            "full name",
            "registrar abuse",
            "registrar",
            "data",
            "v3 serial",
            "code",
            "number",
            "cus odigicert",
            "inc cndigicert",
            "global g2",
            "tls rsa",
            "sha256",
            "united states",
            "power query",
            "microsoft learn",
            "ordenar por",
            "foundry",
            "input",
            "blocked",
            "error id",
            "conector",
            "por ejemplo",
            "sensitive",
            "quickstart",
            "present aug",
            "present oct",
            "unknown ns",
            "showing",
            "present sep",
            "moved",
            "title",
            "files",
            "reverse dns",
            "location united",
            "america flag",
            "america asn",
            "asnone dns",
            "resolutions",
            "dga domain",
            "ipv4 add",
            "url analysis",
            "name servers",
            "div div",
            "expiration date",
            "page",
            "present nov",
            "present jan",
            "present dec",
            "present mar",
            "present feb",
            "virtool",
            "cryp",
            "error",
            "win32",
            "domain",
            "ip address",
            "domain add",
            "next associated",
            "pulse pulses",
            "ashburn",
            "extr referen",
            "exclude",
            "sugges",
            "pulse submit",
            "date",
            "present jul",
            "present jun",
            "fastly error",
            "please",
            "handle",
            "entity",
            "record type",
            "ttl value",
            "msms93992282",
            "read c",
            "show",
            "medium",
            "tlsv1",
            "whitelisted",
            "module load",
            "t1129",
            "execution",
            "dock",
            "write",
            "persistence",
            "next",
            "unknown",
            "connector",
            "cybercrime",
            "harassment"
          ],
          "references": [
            "Products are being abused. Users are over zealous at blocking targets from basic human rights and privacy."
          ],
          "public": 1,
          "adversary": "Quickstart",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Multiple Malware Attack",
              "display_name": "Multiple Malware Attack",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1027.005",
              "name": "Indicator Removal from Tools",
              "display_name": "T1027.005 - Indicator Removal from Tools"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1132.002",
              "name": "Non-Standard Encoding",
              "display_name": "T1132.002 - Non-Standard Encoding"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [
            "Technology",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": "68f9a1ef2dd26ec62a3c298c",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "privacynotacrime",
            "id": "349346",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2865,
            "URL": 5728,
            "email": 11,
            "FileHash-MD5": 91,
            "FileHash-SHA1": 75,
            "FileHash-SHA256": 1713,
            "domain": 1193,
            "CVE": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 11679,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 57,
          "modified_text": "148 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f9288e0d98f3b44c2cb90c",
          "name": "Ultrasounds attack - South African criminal group-Denver, Vo affects critical infrastructure , Oil and public safety",
          "description": "South African and Ethiopian crime group with Denver , Co  presence is not only infiltrating infrastructure from banking to oil, they are human traffickers, hitmen and yes, I received this tip from team member Pheona who a \u2018sassa.gov.za\u2018 South African link recurrently as a top search suggestion in a \u2018targets\u2019  browser. The most frightening piece is that a name listed is of an Ethiopian man who attempted to force a very targeted victim to go somewhere with him,, be his girlfriend and did show up outside of her residence in a different City & County. He also knew the exact name of where she purchased specific items. If you can see this. Please help the best way you can. Something is incredibly wrong. [OTX auto populated Title: We can\u2019t rely on goodwill to protect our critical infrastructure - Help Net Security]",
          "modified": "2025-11-21T18:02:11.054000",
          "created": "2025-10-22T18:55:10.527000",
          "tags": [
            "server nginx",
            "date fri",
            "etag w",
            "urls",
            "passive dns",
            "acceptranges",
            "contentlength",
            "date thu",
            "gmt expires",
            "server",
            "code",
            "link",
            "script script",
            "south africa",
            "ipv4",
            "files",
            "location south",
            "accept",
            "present aug",
            "certificate",
            "hostname add",
            "domain",
            "files ip",
            "unknown a",
            "script urls",
            "ip address",
            "unknown soa",
            "unknown ns",
            "reverse dns",
            "africa flag",
            "asn as16637",
            "dns resolutions",
            "domains top",
            "level",
            "unique tld",
            "related pulses",
            "tags none",
            "indicator facts",
            "title",
            "ipv4 add",
            "opinion",
            "netacea",
            "lockbit",
            "wannacry attack",
            "nhs trusts",
            "council",
            "uk government",
            "protect",
            "cni safe",
            "acls",
            "praio",
            "prink",
            "prsc",
            "prla",
            "lg2en",
            "cti98",
            "search",
            "seiko epson",
            "corporation",
            "arc file",
            "malware",
            "delete c",
            "default",
            "show",
            "write",
            "next",
            "unknown",
            "united",
            "tlsv1",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "as15169",
            "port",
            "execution",
            "dock",
            "capture",
            "persistence",
            "yara detections",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "low risk",
            "cabinet archive",
            "microsoft",
            "read c",
            "dynamicloader",
            "medium",
            "ltda me",
            "high",
            "write c",
            "entries",
            "checks",
            "delphi",
            "win32",
            "url pulse",
            "data upload",
            "extraction",
            "find suggested",
            "type",
            "domain hostname",
            "url add",
            "http",
            "related nids",
            "files location",
            "ireland flag",
            "files domain",
            "chrome",
            "ireland unknown",
            "pulse submit",
            "url analysis",
            "body",
            "date",
            "status",
            "name servers",
            "creation date",
            "expiration date",
            "flag united",
            "destination",
            "systemdrive",
            "html document",
            "crlf line",
            "updater",
            "copy",
            "unknown aaaa",
            "moved",
            "domain add",
            "extri data",
            "enter sc",
            "extr include",
            "review exclude",
            "sugges",
            "present jul",
            "saudi arabia",
            "present mar",
            "present oct",
            "present jun",
            "present feb",
            "present nov",
            "present may",
            "eeee",
            "eeeeeee",
            "eeeeee",
            "eefe",
            "ebeee",
            "ee eme",
            "eeheee",
            "eeefee e",
            "eeeee e",
            "vmprotect",
            "push",
            "local",
            "defender",
            "regsetvalueexa",
            "utf8 unicode"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lockbit",
              "display_name": "Lockbit",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "target": null
            },
            {
              "id": "Other Dangerous Malware",
              "display_name": "Other Dangerous Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1561",
              "name": "Disk Wipe",
              "display_name": "T1561 - Disk Wipe"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [
            "Oil"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 648,
            "hostname": 1604,
            "FileHash-SHA256": 1826,
            "URL": 4153,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 60,
            "SSLCertFingerprint": 18,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 8418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "149 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f93b1cebf80f48450bd517",
          "name": "Yuner - File deletion and Disk Wiping / Cyberstalking ",
          "description": "",
          "modified": "2025-11-21T18:02:11.054000",
          "created": "2025-10-22T20:14:20.632000",
          "tags": [
            "server nginx",
            "date fri",
            "etag w",
            "urls",
            "passive dns",
            "acceptranges",
            "contentlength",
            "date thu",
            "gmt expires",
            "server",
            "code",
            "link",
            "script script",
            "south africa",
            "ipv4",
            "files",
            "location south",
            "accept",
            "present aug",
            "certificate",
            "hostname add",
            "domain",
            "files ip",
            "unknown a",
            "script urls",
            "ip address",
            "unknown soa",
            "unknown ns",
            "reverse dns",
            "africa flag",
            "asn as16637",
            "dns resolutions",
            "domains top",
            "level",
            "unique tld",
            "related pulses",
            "tags none",
            "indicator facts",
            "title",
            "ipv4 add",
            "opinion",
            "netacea",
            "lockbit",
            "wannacry attack",
            "nhs trusts",
            "council",
            "uk government",
            "protect",
            "cni safe",
            "acls",
            "praio",
            "prink",
            "prsc",
            "prla",
            "lg2en",
            "cti98",
            "search",
            "seiko epson",
            "corporation",
            "arc file",
            "malware",
            "delete c",
            "default",
            "show",
            "write",
            "next",
            "unknown",
            "united",
            "tlsv1",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "as15169",
            "port",
            "execution",
            "dock",
            "capture",
            "persistence",
            "yara detections",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "low risk",
            "cabinet archive",
            "microsoft",
            "read c",
            "dynamicloader",
            "medium",
            "ltda me",
            "high",
            "write c",
            "entries",
            "checks",
            "delphi",
            "win32",
            "url pulse",
            "data upload",
            "extraction",
            "find suggested",
            "type",
            "domain hostname",
            "url add",
            "http",
            "related nids",
            "files location",
            "ireland flag",
            "files domain",
            "chrome",
            "ireland unknown",
            "pulse submit",
            "url analysis",
            "body",
            "date",
            "status",
            "name servers",
            "creation date",
            "expiration date",
            "flag united",
            "destination",
            "systemdrive",
            "html document",
            "crlf line",
            "updater",
            "copy",
            "unknown aaaa",
            "moved",
            "domain add",
            "extri data",
            "enter sc",
            "extr include",
            "review exclude",
            "sugges",
            "present jul",
            "saudi arabia",
            "present mar",
            "present oct",
            "present jun",
            "present feb",
            "present nov",
            "present may",
            "eeee",
            "eeeeeee",
            "eeeeee",
            "eefe",
            "ebeee",
            "ee eme",
            "eeheee",
            "eeefee e",
            "eeeee e",
            "vmprotect",
            "push",
            "local",
            "defender",
            "regsetvalueexa",
            "utf8 unicode"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lockbit",
              "display_name": "Lockbit",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "target": null
            },
            {
              "id": "Other Dangerous Malware",
              "display_name": "Other Dangerous Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1561",
              "name": "Disk Wipe",
              "display_name": "T1561 - Disk Wipe"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [
            "Oil"
          ],
          "TLP": "green",
          "cloned_from": "68f9288e0d98f3b44c2cb90c",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 648,
            "hostname": 1604,
            "FileHash-SHA256": 1826,
            "URL": 4153,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 60,
            "SSLCertFingerprint": 18,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 8418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "149 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b",
        "ExternalHosts: US",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "Starfield again - HoneyPot / Dod- DoW",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "http://129.2.4.2/32 Lencr",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "Products are being abused. Users are over zealous at blocking targets from basic human rights and privacy.",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO",
            "Quickstart"
          ],
          "malware_families": [
            "Alf:heraklezeval:pua:win32/ultradownloads",
            "Multiple malware attack",
            "Lockbit",
            "Ransom:win32/crowti",
            "Other dangerous malware",
            "Autoit",
            "Upatre",
            "Win.packer",
            "Backdoor:win32/tofsee.",
            "Win.dropper.vbclone",
            "#lowfi:sigattr:downloadandexecute"
          ],
          "industries": [
            "Oil",
            "Government",
            "Technology"
          ],
          "unique_indicators": 30606
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/hypershield.engineering",
    "whois": "http://whois.domaintools.com/hypershield.engineering",
    "domain": "hypershield.engineering",
    "hostname": "controller.prod.hypershield.engineering"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "68fbc84609098d17c316f23c",
      "name": "NSO - Multiple crimes",
      "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-24T18:41:10.936000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "147 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fc18514965ccd3b55c216d",
      "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
      "description": "",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-25T00:22:41.686000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68fbc84609098d17c316f23c",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "147 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f9a1ef2dd26ec62a3c298c",
      "name": "Listeners - Malicious Over the top espionage | Cyber Warfare?",
      "description": "Cyber attacks on targeted devices stored safely, separately, don\u2019t communicate with one another. PalantirFoundry.com shares IP addresses with Fastly. South African IP\u2019s and DGA domains bounce from US Denver , Co based IP and Domain addresses. Registrar Abuse: HTTP/2 404 content type: text/html content length: 2263 date: Wed 22 Oct 2025 22:32:18 GMT server: Envoy\n443 Certificate Subject: US\n443 Certificate Subject: Colorado\n443 Certificate Subject: Denver\n443 Certificate Subject: Palantir Technologies Inc.\n443 Certificate Subject: listeners.usw-19.palantirfoundry.com",
      "modified": "2025-11-22T00:01:42.464000",
      "created": "2025-10-23T03:33:03.315000",
      "tags": [
        "url https",
        "url http",
        "hostname",
        "mulweli",
        "mphomafmulweli",
        "indicator role",
        "ipv4",
        "type indicator",
        "added active",
        "related pulses",
        "united",
        "envoy error",
        "certificate",
        "urls",
        "emails",
        "active related",
        "africa",
        "span",
        "gmt server",
        "colorado",
        "denver",
        "palantir",
        "listen",
        "listen linda",
        "linda listen",
        "listeners @ dantesdragon",
        "palantir",
        "all y",
        "se referen",
        "data upload",
        "extraction",
        "extra",
        "referen data",
        "overview domain",
        "passive dns",
        "files ip",
        "address",
        "asn asnone",
        "as14618",
        "all se",
        "include review",
        "exclude sugges",
        "failed",
        "typo",
        "status",
        "search",
        "record value",
        "server",
        "domain status",
        "key identifier",
        "x509v3 subject",
        "full name",
        "registrar abuse",
        "registrar",
        "data",
        "v3 serial",
        "code",
        "number",
        "cus odigicert",
        "inc cndigicert",
        "global g2",
        "tls rsa",
        "sha256",
        "united states",
        "power query",
        "microsoft learn",
        "ordenar por",
        "foundry",
        "input",
        "blocked",
        "error id",
        "conector",
        "por ejemplo",
        "sensitive",
        "quickstart",
        "present aug",
        "present oct",
        "unknown ns",
        "showing",
        "present sep",
        "moved",
        "title",
        "files",
        "reverse dns",
        "location united",
        "america flag",
        "america asn",
        "asnone dns",
        "resolutions",
        "dga domain",
        "ipv4 add",
        "url analysis",
        "name servers",
        "div div",
        "expiration date",
        "page",
        "present nov",
        "present jan",
        "present dec",
        "present mar",
        "present feb",
        "virtool",
        "cryp",
        "error",
        "win32",
        "domain",
        "ip address",
        "domain add",
        "next associated",
        "pulse pulses",
        "ashburn",
        "extr referen",
        "exclude",
        "sugges",
        "pulse submit",
        "date",
        "present jul",
        "present jun",
        "fastly error",
        "please",
        "handle",
        "entity",
        "record type",
        "ttl value",
        "msms93992282",
        "read c",
        "show",
        "medium",
        "tlsv1",
        "whitelisted",
        "module load",
        "t1129",
        "execution",
        "dock",
        "write",
        "persistence",
        "next",
        "unknown",
        "connector",
        "cybercrime",
        "harassment"
      ],
      "references": [
        "Products are being abused. Users are over zealous at blocking targets from basic human rights and privacy."
      ],
      "public": 1,
      "adversary": "Quickstart",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Multiple Malware Attack",
          "display_name": "Multiple Malware Attack",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1027.005",
          "name": "Indicator Removal from Tools",
          "display_name": "T1027.005 - Indicator Removal from Tools"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1132.002",
          "name": "Non-Standard Encoding",
          "display_name": "T1132.002 - Non-Standard Encoding"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [
        "Technology",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2865,
        "URL": 5728,
        "email": 11,
        "FileHash-MD5": 91,
        "FileHash-SHA1": 75,
        "FileHash-SHA256": 1713,
        "domain": 1193,
        "CVE": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 11679,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 180,
      "modified_text": "148 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f9a6f4e35193c04401daaf",
      "name": "Emotet & VirTool Obsfuscator - Registrar abuse tracking civilians",
      "description": "",
      "modified": "2025-11-22T00:01:42.464000",
      "created": "2025-10-23T03:54:28.671000",
      "tags": [
        "url https",
        "url http",
        "hostname",
        "mulweli",
        "mphomafmulweli",
        "indicator role",
        "ipv4",
        "type indicator",
        "added active",
        "related pulses",
        "united",
        "envoy error",
        "certificate",
        "urls",
        "emails",
        "active related",
        "africa",
        "span",
        "gmt server",
        "colorado",
        "denver",
        "palantir",
        "listen",
        "listen linda",
        "linda listen",
        "listeners @ dantesdragon",
        "palantir",
        "all y",
        "se referen",
        "data upload",
        "extraction",
        "extra",
        "referen data",
        "overview domain",
        "passive dns",
        "files ip",
        "address",
        "asn asnone",
        "as14618",
        "all se",
        "include review",
        "exclude sugges",
        "failed",
        "typo",
        "status",
        "search",
        "record value",
        "server",
        "domain status",
        "key identifier",
        "x509v3 subject",
        "full name",
        "registrar abuse",
        "registrar",
        "data",
        "v3 serial",
        "code",
        "number",
        "cus odigicert",
        "inc cndigicert",
        "global g2",
        "tls rsa",
        "sha256",
        "united states",
        "power query",
        "microsoft learn",
        "ordenar por",
        "foundry",
        "input",
        "blocked",
        "error id",
        "conector",
        "por ejemplo",
        "sensitive",
        "quickstart",
        "present aug",
        "present oct",
        "unknown ns",
        "showing",
        "present sep",
        "moved",
        "title",
        "files",
        "reverse dns",
        "location united",
        "america flag",
        "america asn",
        "asnone dns",
        "resolutions",
        "dga domain",
        "ipv4 add",
        "url analysis",
        "name servers",
        "div div",
        "expiration date",
        "page",
        "present nov",
        "present jan",
        "present dec",
        "present mar",
        "present feb",
        "virtool",
        "cryp",
        "error",
        "win32",
        "domain",
        "ip address",
        "domain add",
        "next associated",
        "pulse pulses",
        "ashburn",
        "extr referen",
        "exclude",
        "sugges",
        "pulse submit",
        "date",
        "present jul",
        "present jun",
        "fastly error",
        "please",
        "handle",
        "entity",
        "record type",
        "ttl value",
        "msms93992282",
        "read c",
        "show",
        "medium",
        "tlsv1",
        "whitelisted",
        "module load",
        "t1129",
        "execution",
        "dock",
        "write",
        "persistence",
        "next",
        "unknown",
        "connector",
        "cybercrime",
        "harassment"
      ],
      "references": [
        "Products are being abused. Users are over zealous at blocking targets from basic human rights and privacy."
      ],
      "public": 1,
      "adversary": "Quickstart",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Multiple Malware Attack",
          "display_name": "Multiple Malware Attack",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1027.005",
          "name": "Indicator Removal from Tools",
          "display_name": "T1027.005 - Indicator Removal from Tools"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1132.002",
          "name": "Non-Standard Encoding",
          "display_name": "T1132.002 - Non-Standard Encoding"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [
        "Technology",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": "68f9a1ef2dd26ec62a3c298c",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2865,
        "URL": 5728,
        "email": 11,
        "FileHash-MD5": 91,
        "FileHash-SHA1": 75,
        "FileHash-SHA256": 1713,
        "domain": 1193,
        "CVE": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 11679,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "148 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69069167e1e2a222bd7762f2",
      "name": "Palantir - Spyware",
      "description": "",
      "modified": "2025-11-22T00:01:42.464000",
      "created": "2025-11-01T23:01:59.339000",
      "tags": [
        "url https",
        "url http",
        "hostname",
        "mulweli",
        "mphomafmulweli",
        "indicator role",
        "ipv4",
        "type indicator",
        "added active",
        "related pulses",
        "united",
        "envoy error",
        "certificate",
        "urls",
        "emails",
        "active related",
        "africa",
        "span",
        "gmt server",
        "colorado",
        "denver",
        "palantir",
        "listen",
        "listen linda",
        "linda listen",
        "listeners @ dantesdragon",
        "palantir",
        "all y",
        "se referen",
        "data upload",
        "extraction",
        "extra",
        "referen data",
        "overview domain",
        "passive dns",
        "files ip",
        "address",
        "asn asnone",
        "as14618",
        "all se",
        "include review",
        "exclude sugges",
        "failed",
        "typo",
        "status",
        "search",
        "record value",
        "server",
        "domain status",
        "key identifier",
        "x509v3 subject",
        "full name",
        "registrar abuse",
        "registrar",
        "data",
        "v3 serial",
        "code",
        "number",
        "cus odigicert",
        "inc cndigicert",
        "global g2",
        "tls rsa",
        "sha256",
        "united states",
        "power query",
        "microsoft learn",
        "ordenar por",
        "foundry",
        "input",
        "blocked",
        "error id",
        "conector",
        "por ejemplo",
        "sensitive",
        "quickstart",
        "present aug",
        "present oct",
        "unknown ns",
        "showing",
        "present sep",
        "moved",
        "title",
        "files",
        "reverse dns",
        "location united",
        "america flag",
        "america asn",
        "asnone dns",
        "resolutions",
        "dga domain",
        "ipv4 add",
        "url analysis",
        "name servers",
        "div div",
        "expiration date",
        "page",
        "present nov",
        "present jan",
        "present dec",
        "present mar",
        "present feb",
        "virtool",
        "cryp",
        "error",
        "win32",
        "domain",
        "ip address",
        "domain add",
        "next associated",
        "pulse pulses",
        "ashburn",
        "extr referen",
        "exclude",
        "sugges",
        "pulse submit",
        "date",
        "present jul",
        "present jun",
        "fastly error",
        "please",
        "handle",
        "entity",
        "record type",
        "ttl value",
        "msms93992282",
        "read c",
        "show",
        "medium",
        "tlsv1",
        "whitelisted",
        "module load",
        "t1129",
        "execution",
        "dock",
        "write",
        "persistence",
        "next",
        "unknown",
        "connector",
        "cybercrime",
        "harassment"
      ],
      "references": [
        "Products are being abused. Users are over zealous at blocking targets from basic human rights and privacy."
      ],
      "public": 1,
      "adversary": "Quickstart",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Multiple Malware Attack",
          "display_name": "Multiple Malware Attack",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1027.005",
          "name": "Indicator Removal from Tools",
          "display_name": "T1027.005 - Indicator Removal from Tools"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1132.002",
          "name": "Non-Standard Encoding",
          "display_name": "T1132.002 - Non-Standard Encoding"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [
        "Technology",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": "68f9a1ef2dd26ec62a3c298c",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "privacynotacrime",
        "id": "349346",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2865,
        "URL": 5728,
        "email": 11,
        "FileHash-MD5": 91,
        "FileHash-SHA1": 75,
        "FileHash-SHA256": 1713,
        "domain": 1193,
        "CVE": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 11679,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 57,
      "modified_text": "148 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f9288e0d98f3b44c2cb90c",
      "name": "Ultrasounds attack - South African criminal group-Denver, Vo affects critical infrastructure , Oil and public safety",
      "description": "South African and Ethiopian crime group with Denver , Co  presence is not only infiltrating infrastructure from banking to oil, they are human traffickers, hitmen and yes, I received this tip from team member Pheona who a \u2018sassa.gov.za\u2018 South African link recurrently as a top search suggestion in a \u2018targets\u2019  browser. The most frightening piece is that a name listed is of an Ethiopian man who attempted to force a very targeted victim to go somewhere with him,, be his girlfriend and did show up outside of her residence in a different City & County. He also knew the exact name of where she purchased specific items. If you can see this. Please help the best way you can. Something is incredibly wrong. [OTX auto populated Title: We can\u2019t rely on goodwill to protect our critical infrastructure - Help Net Security]",
      "modified": "2025-11-21T18:02:11.054000",
      "created": "2025-10-22T18:55:10.527000",
      "tags": [
        "server nginx",
        "date fri",
        "etag w",
        "urls",
        "passive dns",
        "acceptranges",
        "contentlength",
        "date thu",
        "gmt expires",
        "server",
        "code",
        "link",
        "script script",
        "south africa",
        "ipv4",
        "files",
        "location south",
        "accept",
        "present aug",
        "certificate",
        "hostname add",
        "domain",
        "files ip",
        "unknown a",
        "script urls",
        "ip address",
        "unknown soa",
        "unknown ns",
        "reverse dns",
        "africa flag",
        "asn as16637",
        "dns resolutions",
        "domains top",
        "level",
        "unique tld",
        "related pulses",
        "tags none",
        "indicator facts",
        "title",
        "ipv4 add",
        "opinion",
        "netacea",
        "lockbit",
        "wannacry attack",
        "nhs trusts",
        "council",
        "uk government",
        "protect",
        "cni safe",
        "acls",
        "praio",
        "prink",
        "prsc",
        "prla",
        "lg2en",
        "cti98",
        "search",
        "seiko epson",
        "corporation",
        "arc file",
        "malware",
        "delete c",
        "default",
        "show",
        "write",
        "next",
        "unknown",
        "united",
        "tlsv1",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "as15169",
        "port",
        "execution",
        "dock",
        "capture",
        "persistence",
        "yara detections",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "low risk",
        "cabinet archive",
        "microsoft",
        "read c",
        "dynamicloader",
        "medium",
        "ltda me",
        "high",
        "write c",
        "entries",
        "checks",
        "delphi",
        "win32",
        "url pulse",
        "data upload",
        "extraction",
        "find suggested",
        "type",
        "domain hostname",
        "url add",
        "http",
        "related nids",
        "files location",
        "ireland flag",
        "files domain",
        "chrome",
        "ireland unknown",
        "pulse submit",
        "url analysis",
        "body",
        "date",
        "status",
        "name servers",
        "creation date",
        "expiration date",
        "flag united",
        "destination",
        "systemdrive",
        "html document",
        "crlf line",
        "updater",
        "copy",
        "unknown aaaa",
        "moved",
        "domain add",
        "extri data",
        "enter sc",
        "extr include",
        "review exclude",
        "sugges",
        "present jul",
        "saudi arabia",
        "present mar",
        "present oct",
        "present jun",
        "present feb",
        "present nov",
        "present may",
        "eeee",
        "eeeeeee",
        "eeeeee",
        "eefe",
        "ebeee",
        "ee eme",
        "eeheee",
        "eeefee e",
        "eeeee e",
        "vmprotect",
        "push",
        "local",
        "defender",
        "regsetvalueexa",
        "utf8 unicode"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lockbit",
          "display_name": "Lockbit",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "target": null
        },
        {
          "id": "Other Dangerous Malware",
          "display_name": "Other Dangerous Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1561",
          "name": "Disk Wipe",
          "display_name": "T1561 - Disk Wipe"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [
        "Oil"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 648,
        "hostname": 1604,
        "FileHash-SHA256": 1826,
        "URL": 4153,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 60,
        "SSLCertFingerprint": 18,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 8418,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "149 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f93b1cebf80f48450bd517",
      "name": "Yuner - File deletion and Disk Wiping / Cyberstalking ",
      "description": "",
      "modified": "2025-11-21T18:02:11.054000",
      "created": "2025-10-22T20:14:20.632000",
      "tags": [
        "server nginx",
        "date fri",
        "etag w",
        "urls",
        "passive dns",
        "acceptranges",
        "contentlength",
        "date thu",
        "gmt expires",
        "server",
        "code",
        "link",
        "script script",
        "south africa",
        "ipv4",
        "files",
        "location south",
        "accept",
        "present aug",
        "certificate",
        "hostname add",
        "domain",
        "files ip",
        "unknown a",
        "script urls",
        "ip address",
        "unknown soa",
        "unknown ns",
        "reverse dns",
        "africa flag",
        "asn as16637",
        "dns resolutions",
        "domains top",
        "level",
        "unique tld",
        "related pulses",
        "tags none",
        "indicator facts",
        "title",
        "ipv4 add",
        "opinion",
        "netacea",
        "lockbit",
        "wannacry attack",
        "nhs trusts",
        "council",
        "uk government",
        "protect",
        "cni safe",
        "acls",
        "praio",
        "prink",
        "prsc",
        "prla",
        "lg2en",
        "cti98",
        "search",
        "seiko epson",
        "corporation",
        "arc file",
        "malware",
        "delete c",
        "default",
        "show",
        "write",
        "next",
        "unknown",
        "united",
        "tlsv1",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "as15169",
        "port",
        "execution",
        "dock",
        "capture",
        "persistence",
        "yara detections",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "low risk",
        "cabinet archive",
        "microsoft",
        "read c",
        "dynamicloader",
        "medium",
        "ltda me",
        "high",
        "write c",
        "entries",
        "checks",
        "delphi",
        "win32",
        "url pulse",
        "data upload",
        "extraction",
        "find suggested",
        "type",
        "domain hostname",
        "url add",
        "http",
        "related nids",
        "files location",
        "ireland flag",
        "files domain",
        "chrome",
        "ireland unknown",
        "pulse submit",
        "url analysis",
        "body",
        "date",
        "status",
        "name servers",
        "creation date",
        "expiration date",
        "flag united",
        "destination",
        "systemdrive",
        "html document",
        "crlf line",
        "updater",
        "copy",
        "unknown aaaa",
        "moved",
        "domain add",
        "extri data",
        "enter sc",
        "extr include",
        "review exclude",
        "sugges",
        "present jul",
        "saudi arabia",
        "present mar",
        "present oct",
        "present jun",
        "present feb",
        "present nov",
        "present may",
        "eeee",
        "eeeeeee",
        "eeeeee",
        "eefe",
        "ebeee",
        "ee eme",
        "eeheee",
        "eeefee e",
        "eeeee e",
        "vmprotect",
        "push",
        "local",
        "defender",
        "regsetvalueexa",
        "utf8 unicode"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lockbit",
          "display_name": "Lockbit",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "target": null
        },
        {
          "id": "Other Dangerous Malware",
          "display_name": "Other Dangerous Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1561",
          "name": "Disk Wipe",
          "display_name": "T1561 - Disk Wipe"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [
        "Oil"
      ],
      "TLP": "green",
      "cloned_from": "68f9288e0d98f3b44c2cb90c",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 648,
        "hostname": 1604,
        "FileHash-SHA256": 1826,
        "URL": 4153,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 60,
        "SSLCertFingerprint": 18,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 8418,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "149 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://controller.prod.hypershield.engineering/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://controller.prod.hypershield.engineering/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638905.0294092
}