{
  "type": "URL",
  "indicator": "https://cpcontacts.font.is",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cpcontacts.font.is",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4155100644,
      "indicator": "https://cpcontacts.font.is",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "695c7b40f5d2f292a7512e81",
          "name": "USteal Reputation Smear  | Malicious Media | TrojanSpy - CrazyFrost.com",
          "description": "Who is CrazyFrost? USteal Reputation Smear  | Malicious Media | TrojanSpy would affect anyone who clicks on honeypot / dga domain. iPhone spyware. We\u2019ve been working on exposing spyware. Emotet / AutoIT , cabs, password stealer, and more found. Investigators and attorneys from the past Investigators reported victims life, was being promoted over the dark web. From bathing to cooking , conversations to arguments, getting dressed to passing gas. Haha. Small cameras were accessed remotely in her former. Castle Pines, Co hideaway. A third investigator confirmed tiny cameras were installed when victim was in staycationing. When family arrived home garage door  and secured doors were boldly left open. Crazy True. [otx auto generated- The following is the full text of the public-key-precert-scts, which has been posted on the website of Redporn.video, the site of an unauthorised sex tape.]",
          "modified": "2026-02-05T02:03:26.707000",
          "created": "2026-01-06T03:02:24.932000",
          "tags": [
            "gmtn",
            "log id",
            "ca issuers",
            "b0n timestamp",
            "signature",
            "d097",
            "f2334482",
            "fc46",
            "b10b2898797d",
            "fingerprintsha1",
            "tsara",
            "we1 certificate",
            "dynamicloader",
            "medium",
            "write c",
            "host",
            "yara rule",
            "myapp",
            "delphi",
            "worm",
            "win32",
            "error",
            "write",
            "code",
            "malware",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "ssl certificate",
            "execution att",
            "t1204 user",
            "united",
            "mitre att",
            "ck matrix",
            "flag",
            "ogoogle trust",
            "href",
            "network traffic",
            "span",
            "babe",
            "super",
            "close",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "strings",
            "form",
            "extraction",
            "data upload",
            "all ht",
            "enter source",
            "one on",
            "tezunau",
            "daut un",
            "dauwol lype",
            "ur extraction",
            "extrac",
            "n tezunau",
            "one opa",
            "included review",
            "faileextra",
            "include data",
            "review exclude",
            "sugges",
            "delete c",
            "json",
            "ascii text",
            "high",
            "data",
            "search",
            "stream",
            "unknown",
            "push",
            "next",
            "dirty",
            "enter s",
            "type",
            "extr data",
            "include",
            "ff d5",
            "ee fc",
            "eb d8",
            "f0 ff",
            "ff bb",
            "fd ff",
            "ff eb",
            "ed b8",
            "agent",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "read c",
            "execution",
            "dock",
            "persistence",
            "sc data",
            "present jan",
            "present mar",
            "present dec",
            "unknown aaaa",
            "passive dns",
            "urls",
            "trojanspy",
            "date",
            "present feb",
            "susp",
            "moved",
            "ip address",
            "backdoor",
            "usteal",
            "body",
            "title",
            "hybrid",
            "regopenkeyexa",
            "memcommit",
            "regsz",
            "english",
            "copy",
            "ufr stealer",
            "markus",
            "april",
            "updater",
            "entries",
            "rsds",
            "c reg",
            "environment",
            "launch"
          ],
          "references": [
            "https://www.redporn.video/tsara-brashears-slandered-.htm \u2022 www.redporn.video \u2022 http://www.redporn",
            "guidepaparazzisurface.com",
            "http://www.crazyfrost.com\t\u2022 http://www.crazyfrost",
            "http://chaturbate.com/notabottom/\t\u2022 http://chaturbate.com/notabottom/\\",
            "iPhone Spyware - https://bam.nr-data.net/1/6f524845d1?a=24279235&v=1169.7b094c0&to=MwYEbUdYXxJQWhULDApMIExbWkUIXldOAQsFF0hPXFxGEgtrDg0OMgoDThteVBU%3D&rst=6546&ck=1&ref=https://chaturbate.com/notabottom/&ap=123&fe=4218&dc=4218&af=err",
            "iPhone Spyware - https://bam.nr-data.net/jserrors/ping/6f524845d1?a=24279235&v=1169.7b094c0&to=MwYEbUdYXxJQWhULDApMIExbWkUIXldOAQsFF0hPXFxGEgtrDg0OMgoDThteVBU%3D&rst=6546&ck=1&ref=https://chaturbate.com/notabottom/",
            "https://chaturbate.com/notabottom/",
            "https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1390847564&t=pageview&_s=1&dl=https%3A%2F%2Fchaturbate.com%2Fnotabottom%2F&ul=en-us&de=utf-8&dt=Chaturbate%20-%20100%25%20Free%20Chat%20%26%20Webcams&sd=32-bit&sr=1024x768&vp=780x439&je=0&_u=YEBAAE~&jid=915940444&gjid=1686072238&cid=922362881.1595496808&tid=UA-23607725-1&_gid=1317601001.1595496808&_r=1&cd1=chaturbate.com&cd2=&cd3=-&cd4=&cd5=anonymous&z=762468946"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "AutoIT",
              "display_name": "AutoIT",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Usteal",
              "display_name": "TrojanSpy:Win32/Usteal",
              "target": "/malware/TrojanSpy:Win32/Usteal"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1204.003",
              "name": "Malicious Image",
              "display_name": "T1204.003 - Malicious Image"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2543,
            "hostname": 848,
            "FileHash-SHA256": 1320,
            "SSLCertFingerprint": 25,
            "domain": 463,
            "FileHash-MD5": 418,
            "FileHash-SHA1": 197,
            "email": 2
          },
          "indicator_count": 5816,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "74 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6928f8d9e4222a6a219d785e",
          "name": "ClipBanker Spy & Information stealer | Crazy Frost | MaaS | Chrome & Cloudflare attacks",
          "description": "It appears that entity CrazyFrost provides MasS among other things that include major smear campaigns.| Likely quasi government , and Law Firm contractors.. Domestic terrorizing isn\u2019t a stretch.\nClipBanker: A form of banking trojan information stealer and spy that specifically monitors and steals information, likely by modifying the clipboard contents to redirect financial transactions (e.g., changing a copied bank account number to the attacker's).\n\n[OTX populated - HOSTNAME: CloudFlare.com.., a company owned by the US government, has been added to Pulse, an anti-virus database. (Pulses) created by users.]",
          "modified": "2025-12-28T00:04:06.179000",
          "created": "2025-11-28T01:20:25.401000",
          "tags": [
            "dynamicloader",
            "json",
            "ascii text",
            "high",
            "data",
            "x90uxa4xf8",
            "cape",
            "stream",
            "guard",
            "write",
            "trojan",
            "redline",
            "malware",
            "push",
            "local",
            "injection_inter_process",
            "recon_fingerprint",
            "persistence_ads",
            "process_creation_suspicious_location",
            "infostealer_browser",
            "infostealer_cookies",
            "stealth_file",
            "cape_detected_threat",
            "antivm_generic_bios",
            "cape_extracted_content",
            "united",
            "mtb jul",
            "a domains",
            "aaaa",
            "443 ma86400",
            "servers",
            "win32upatre jul",
            "virtool",
            "b778b1",
            "div div",
            "d9e4f4",
            "edf2f8",
            "present mar",
            "fastest privacy",
            "first dns",
            "win32",
            "trojandropper",
            "passive dns",
            "mtb nov",
            "ipv4 add",
            "asn as13335",
            "dns resolutions",
            "domain",
            "data upload",
            "extraction",
            "yara",
            "troja yara",
            "trojar data",
            "virto",
            "worn data",
            "included iocs",
            "manually add",
            "resolved ips",
            "ta0002",
            "evasion ta0005",
            "tr shared",
            "modules",
            "files",
            "infor",
            "t1027",
            "process t1057",
            "community score",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "defense evasion",
            "spawns",
            "flag",
            "name server",
            "date",
            "cloudflare",
            "data protected",
            "misc activity",
            "et info",
            "dns requests",
            "domain address",
            "gmt flag",
            "techtarget",
            "server",
            "et policy",
            "prefetch2",
            "t1179 hooking",
            "access windows",
            "installs",
            "mitre att",
            "ck techniques",
            "click",
            "windir",
            "country",
            "contacted hosts",
            "ip address",
            "process details",
            "contacted",
            "http traffic",
            "suricata alerts",
            "event category",
            "found"
          ],
          "references": [
            "Malware : ClipBanker Entity: Crazy Frost",
            "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "Services : GoogleChromeElevationService = Delete",
            "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
            "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
            "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
            "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
            "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
            "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
            "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
            "CS IDS: Matches rule (http_inspect) invalid status line",
            "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
            "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube/"
          ],
          "public": 1,
          "adversary": "Crazy Frost",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Trojan.Disfa/downloader10",
              "display_name": "Trojan.Disfa/downloader10",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "Rozena",
              "display_name": "Rozena",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1464",
              "name": "Jamming or Denial of Service",
              "display_name": "T1464 - Jamming or Denial of Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 295,
            "FileHash-SHA1": 217,
            "FileHash-SHA256": 1887,
            "URL": 3263,
            "domain": 597,
            "hostname": 1085,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 7347,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "113 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://chaturbate.com/notabottom/\t\u2022 http://chaturbate.com/notabottom/\\",
        "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
        "CS IDS: Matches rule (http_inspect) invalid status line",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
        "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
        "Services : GoogleChromeElevationService = Delete",
        "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
        "iPhone Spyware - https://bam.nr-data.net/jserrors/ping/6f524845d1?a=24279235&v=1169.7b094c0&to=MwYEbUdYXxJQWhULDApMIExbWkUIXldOAQsFF0hPXFxGEgtrDg0OMgoDThteVBU%3D&rst=6546&ck=1&ref=https://chaturbate.com/notabottom/",
        "http://www.anyxxxtube/",
        "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
        "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "https://chaturbate.com/notabottom/",
        "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
        "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
        "iPhone Spyware - https://bam.nr-data.net/1/6f524845d1?a=24279235&v=1169.7b094c0&to=MwYEbUdYXxJQWhULDApMIExbWkUIXldOAQsFF0hPXFxGEgtrDg0OMgoDThteVBU%3D&rst=6546&ck=1&ref=https://chaturbate.com/notabottom/&ap=123&fe=4218&dc=4218&af=err",
        "Malware : ClipBanker Entity: Crazy Frost",
        "https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1390847564&t=pageview&_s=1&dl=https%3A%2F%2Fchaturbate.com%2Fnotabottom%2F&ul=en-us&de=utf-8&dt=Chaturbate%20-%20100%25%20Free%20Chat%20%26%20Webcams&sd=32-bit&sr=1024x768&vp=780x439&je=0&_u=YEBAAE~&jid=915940444&gjid=1686072238&cid=922362881.1595496808&tid=UA-23607725-1&_gid=1317601001.1595496808&_r=1&cd1=chaturbate.com&cd2=&cd3=-&cd4=&cd5=anonymous&z=762468946",
        "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
        "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
        "https://www.redporn.video/tsara-brashears-slandered-.htm \u2022 www.redporn.video \u2022 http://www.redporn",
        "http://www.crazyfrost.com\t\u2022 http://www.crazyfrost",
        "guidepaparazzisurface.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Crazy Frost"
          ],
          "malware_families": [
            "Trojanspy:win32/usteal",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Other malware",
            "Trojan:win32/zusy",
            "Trojan.disfa/downloader10",
            "Autoit",
            "Rozena"
          ],
          "industries": [],
          "unique_indicators": 12447
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/font.is",
    "whois": "http://whois.domaintools.com/font.is",
    "domain": "font.is",
    "hostname": "cpcontacts.font.is"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "695c7b40f5d2f292a7512e81",
      "name": "USteal Reputation Smear  | Malicious Media | TrojanSpy - CrazyFrost.com",
      "description": "Who is CrazyFrost? USteal Reputation Smear  | Malicious Media | TrojanSpy would affect anyone who clicks on honeypot / dga domain. iPhone spyware. We\u2019ve been working on exposing spyware. Emotet / AutoIT , cabs, password stealer, and more found. Investigators and attorneys from the past Investigators reported victims life, was being promoted over the dark web. From bathing to cooking , conversations to arguments, getting dressed to passing gas. Haha. Small cameras were accessed remotely in her former. Castle Pines, Co hideaway. A third investigator confirmed tiny cameras were installed when victim was in staycationing. When family arrived home garage door  and secured doors were boldly left open. Crazy True. [otx auto generated- The following is the full text of the public-key-precert-scts, which has been posted on the website of Redporn.video, the site of an unauthorised sex tape.]",
      "modified": "2026-02-05T02:03:26.707000",
      "created": "2026-01-06T03:02:24.932000",
      "tags": [
        "gmtn",
        "log id",
        "ca issuers",
        "b0n timestamp",
        "signature",
        "d097",
        "f2334482",
        "fc46",
        "b10b2898797d",
        "fingerprintsha1",
        "tsara",
        "we1 certificate",
        "dynamicloader",
        "medium",
        "write c",
        "host",
        "yara rule",
        "myapp",
        "delphi",
        "worm",
        "win32",
        "error",
        "write",
        "code",
        "malware",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "ssl certificate",
        "execution att",
        "t1204 user",
        "united",
        "mitre att",
        "ck matrix",
        "flag",
        "ogoogle trust",
        "href",
        "network traffic",
        "span",
        "babe",
        "super",
        "close",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "strings",
        "form",
        "extraction",
        "data upload",
        "all ht",
        "enter source",
        "one on",
        "tezunau",
        "daut un",
        "dauwol lype",
        "ur extraction",
        "extrac",
        "n tezunau",
        "one opa",
        "included review",
        "faileextra",
        "include data",
        "review exclude",
        "sugges",
        "delete c",
        "json",
        "ascii text",
        "high",
        "data",
        "search",
        "stream",
        "unknown",
        "push",
        "next",
        "dirty",
        "enter s",
        "type",
        "extr data",
        "include",
        "ff d5",
        "ee fc",
        "eb d8",
        "f0 ff",
        "ff bb",
        "fd ff",
        "ff eb",
        "ed b8",
        "agent",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "read c",
        "execution",
        "dock",
        "persistence",
        "sc data",
        "present jan",
        "present mar",
        "present dec",
        "unknown aaaa",
        "passive dns",
        "urls",
        "trojanspy",
        "date",
        "present feb",
        "susp",
        "moved",
        "ip address",
        "backdoor",
        "usteal",
        "body",
        "title",
        "hybrid",
        "regopenkeyexa",
        "memcommit",
        "regsz",
        "english",
        "copy",
        "ufr stealer",
        "markus",
        "april",
        "updater",
        "entries",
        "rsds",
        "c reg",
        "environment",
        "launch"
      ],
      "references": [
        "https://www.redporn.video/tsara-brashears-slandered-.htm \u2022 www.redporn.video \u2022 http://www.redporn",
        "guidepaparazzisurface.com",
        "http://www.crazyfrost.com\t\u2022 http://www.crazyfrost",
        "http://chaturbate.com/notabottom/\t\u2022 http://chaturbate.com/notabottom/\\",
        "iPhone Spyware - https://bam.nr-data.net/1/6f524845d1?a=24279235&v=1169.7b094c0&to=MwYEbUdYXxJQWhULDApMIExbWkUIXldOAQsFF0hPXFxGEgtrDg0OMgoDThteVBU%3D&rst=6546&ck=1&ref=https://chaturbate.com/notabottom/&ap=123&fe=4218&dc=4218&af=err",
        "iPhone Spyware - https://bam.nr-data.net/jserrors/ping/6f524845d1?a=24279235&v=1169.7b094c0&to=MwYEbUdYXxJQWhULDApMIExbWkUIXldOAQsFF0hPXFxGEgtrDg0OMgoDThteVBU%3D&rst=6546&ck=1&ref=https://chaturbate.com/notabottom/",
        "https://chaturbate.com/notabottom/",
        "https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1390847564&t=pageview&_s=1&dl=https%3A%2F%2Fchaturbate.com%2Fnotabottom%2F&ul=en-us&de=utf-8&dt=Chaturbate%20-%20100%25%20Free%20Chat%20%26%20Webcams&sd=32-bit&sr=1024x768&vp=780x439&je=0&_u=YEBAAE~&jid=915940444&gjid=1686072238&cid=922362881.1595496808&tid=UA-23607725-1&_gid=1317601001.1595496808&_r=1&cd1=chaturbate.com&cd2=&cd3=-&cd4=&cd5=anonymous&z=762468946"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "AutoIT",
          "display_name": "AutoIT",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Usteal",
          "display_name": "TrojanSpy:Win32/Usteal",
          "target": "/malware/TrojanSpy:Win32/Usteal"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1204.003",
          "name": "Malicious Image",
          "display_name": "T1204.003 - Malicious Image"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2543,
        "hostname": 848,
        "FileHash-SHA256": 1320,
        "SSLCertFingerprint": 25,
        "domain": 463,
        "FileHash-MD5": 418,
        "FileHash-SHA1": 197,
        "email": 2
      },
      "indicator_count": 5816,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "74 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6928f8d9e4222a6a219d785e",
      "name": "ClipBanker Spy & Information stealer | Crazy Frost | MaaS | Chrome & Cloudflare attacks",
      "description": "It appears that entity CrazyFrost provides MasS among other things that include major smear campaigns.| Likely quasi government , and Law Firm contractors.. Domestic terrorizing isn\u2019t a stretch.\nClipBanker: A form of banking trojan information stealer and spy that specifically monitors and steals information, likely by modifying the clipboard contents to redirect financial transactions (e.g., changing a copied bank account number to the attacker's).\n\n[OTX populated - HOSTNAME: CloudFlare.com.., a company owned by the US government, has been added to Pulse, an anti-virus database. (Pulses) created by users.]",
      "modified": "2025-12-28T00:04:06.179000",
      "created": "2025-11-28T01:20:25.401000",
      "tags": [
        "dynamicloader",
        "json",
        "ascii text",
        "high",
        "data",
        "x90uxa4xf8",
        "cape",
        "stream",
        "guard",
        "write",
        "trojan",
        "redline",
        "malware",
        "push",
        "local",
        "injection_inter_process",
        "recon_fingerprint",
        "persistence_ads",
        "process_creation_suspicious_location",
        "infostealer_browser",
        "infostealer_cookies",
        "stealth_file",
        "cape_detected_threat",
        "antivm_generic_bios",
        "cape_extracted_content",
        "united",
        "mtb jul",
        "a domains",
        "aaaa",
        "443 ma86400",
        "servers",
        "win32upatre jul",
        "virtool",
        "b778b1",
        "div div",
        "d9e4f4",
        "edf2f8",
        "present mar",
        "fastest privacy",
        "first dns",
        "win32",
        "trojandropper",
        "passive dns",
        "mtb nov",
        "ipv4 add",
        "asn as13335",
        "dns resolutions",
        "domain",
        "data upload",
        "extraction",
        "yara",
        "troja yara",
        "trojar data",
        "virto",
        "worn data",
        "included iocs",
        "manually add",
        "resolved ips",
        "ta0002",
        "evasion ta0005",
        "tr shared",
        "modules",
        "files",
        "infor",
        "t1027",
        "process t1057",
        "community score",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "defense evasion",
        "spawns",
        "flag",
        "name server",
        "date",
        "cloudflare",
        "data protected",
        "misc activity",
        "et info",
        "dns requests",
        "domain address",
        "gmt flag",
        "techtarget",
        "server",
        "et policy",
        "prefetch2",
        "t1179 hooking",
        "access windows",
        "installs",
        "mitre att",
        "ck techniques",
        "click",
        "windir",
        "country",
        "contacted hosts",
        "ip address",
        "process details",
        "contacted",
        "http traffic",
        "suricata alerts",
        "event category",
        "found"
      ],
      "references": [
        "Malware : ClipBanker Entity: Crazy Frost",
        "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "Services : GoogleChromeElevationService = Delete",
        "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
        "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
        "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
        "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
        "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
        "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
        "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
        "CS IDS: Matches rule (http_inspect) invalid status line",
        "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
        "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube/"
      ],
      "public": 1,
      "adversary": "Crazy Frost",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Trojan.Disfa/downloader10",
          "display_name": "Trojan.Disfa/downloader10",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "Rozena",
          "display_name": "Rozena",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1464",
          "name": "Jamming or Denial of Service",
          "display_name": "T1464 - Jamming or Denial of Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 295,
        "FileHash-SHA1": 217,
        "FileHash-SHA256": 1887,
        "URL": 3263,
        "domain": 597,
        "hostname": 1085,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 7347,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "113 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cpcontacts.font.is",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cpcontacts.font.is",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776660969.0179272
}