{
  "type": "URL",
  "indicator": "https://dash.casa.moda/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://dash.casa.moda/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4096413775,
      "indicator": "https://dash.casa.moda/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68fbc84609098d17c316f23c",
          "name": "NSO - Multiple crimes",
          "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-24T18:41:10.936000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fc18514965ccd3b55c216d",
          "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
          "description": "",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-25T00:22:41.686000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68fbc84609098d17c316f23c",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687b5499d48de6e54f3bff11",
          "name": "213.174.130.70 - Spyware Install  | Emotet via Malware sites",
          "description": "Malicious IP address for multiple malware domains. Very malicious spyware, will hijack network and devices. \n\u2022 Best Targeted sites \nSpyware Install\n\u2022 Garveep POST CnC\nBeacon\n\u2022 Worm.Mydoom\nCheckin\n\n#endgame #emotet #mydoom #malware_domains #install_spyware #monitered_targets",
          "modified": "2025-08-18T08:00:43.712000",
          "created": "2025-07-19T08:17:29.443000",
          "tags": [
            "handle",
            "ripe ncc",
            "ripe network",
            "address range",
            "cidr",
            "allocation type",
            "assigned pa",
            "status",
            "whois server",
            "entity ah36ripe",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "cnsectigo rsa",
            "secure server",
            "ca validity",
            "date",
            "abuse contact",
            "orgid",
            "orgtechhandle",
            "address",
            "orgabuseref",
            "postalcode",
            "ripe",
            "seen",
            "update date",
            "tech email",
            "admin country",
            "expiration date",
            "dnssec",
            "admin id",
            "mi11255597wp",
            "msie",
            "chrome",
            "passive dns",
            "united",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "urls",
            "files",
            "hosting",
            "open",
            "body",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "anorexx",
            "video",
            "father sex",
            "ebony riding",
            "ebony",
            "roberta",
            "type win32",
            "exe size",
            "mb first",
            "file name",
            "sentinelone",
            "present jul",
            "present oct",
            "entries http",
            "memcommit",
            "t1055",
            "read c",
            "search",
            "entries",
            "show",
            "medium",
            "showing",
            "high process",
            "injection t1055",
            "copy",
            "write",
            "win32",
            "malware",
            "tsara brashears",
            "tsara",
            "pornhub",
            "porn videos",
            "watch tsara",
            "most relevant",
            "open threat",
            "exchange",
            "public",
            "https",
            "green",
            "daily",
            "brashears",
            "porn",
            "watch",
            "busty xxx",
            "filter tsara",
            "brashears porn",
            "url add",
            "pulse pulses",
            "http",
            "related pulses",
            "none related",
            "tags none",
            "file type",
            "md5 sha256",
            "google safe",
            "browsing",
            "dynamicloader",
            "dynamic",
            "read",
            "delete",
            "mtb apr",
            "trojan",
            "lowfi",
            "virtool",
            "icloader apr",
            "otx telemetry",
            "australia",
            "exploit",
            "cobalt strike",
            "hostile",
            "trojanspy",
            "msil",
            "win64",
            "pulse",
            "alerts",
            "yara rule",
            "named pipe",
            "xe7xf3xf2x14x9d",
            "high",
            "delphi",
            "local",
            "next",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "defense evasion",
            "adversaries",
            "spawns",
            "found",
            "process details",
            "flag",
            "contacted",
            "meta",
            "location united",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "size",
            "beginstring",
            "null",
            "type data",
            "error",
            "span",
            "hybrid",
            "general",
            "click",
            "strings",
            "refresh",
            "tools",
            "pattern match",
            "show technique",
            "mitre att",
            "ck matrix",
            "ascii text",
            "show process",
            "utf8",
            "crlf line",
            "network traffic",
            "path",
            "included",
            "review",
            "excludea",
            "sugges data",
            "typ url",
            "url url",
            "url hos",
            "hos hos",
            "extraction f",
            "enter so",
            "u extractio",
            "extra data",
            "included review",
            "ic excluded",
            "suggeste",
            "pulses",
            "md5 google",
            "safe browsing",
            "virustotal api",
            "comments",
            "ally s",
            "extraction data",
            "enter soudcfidi",
            "ad temdac",
            "cddad ad",
            "praw type",
            "extr",
            "include u",
            "creation date",
            "record value",
            "gmt content",
            "x adblock",
            "certificate",
            "domain",
            "encrypt",
            "sec ch",
            "ch ua",
            "unknown aaaa",
            "ua full",
            "ua platform",
            "present jun",
            "moved",
            "ip address",
            "doctype html",
            "lander script",
            "head",
            "method",
            "allowed date",
            "arizona",
            "scottsdale",
            "go daddy",
            "authority",
            "next associated",
            "extraction fail",
            "enter soupce",
            "udi ad",
            "trydda dada",
            "panca type",
            "ur extraction",
            "s data",
            "pr extract",
            "servers",
            "hostname",
            "files ip",
            "denmark unknown"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 4,
            "URL": 7528,
            "domain": 1822,
            "hostname": 2015,
            "email": 5,
            "FileHash-MD5": 373,
            "FileHash-SHA1": 363,
            "FileHash-SHA256": 1939
          },
          "indicator_count": 14049,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "244 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "Starfield again - HoneyPot / Dod- DoW",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "http://129.2.4.2/32 Lencr",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "ExternalHosts: US"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO"
          ],
          "malware_families": [
            "Backdoor:win32/tofsee.",
            "Win.packer",
            "#lowfi:sigattr:downloadandexecute",
            "Win.dropper.vbclone",
            "Autoit",
            "Upatre",
            "Ransom:win32/crowti"
          ],
          "industries": [],
          "unique_indicators": 26554
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/casa.moda",
    "whois": "http://whois.domaintools.com/casa.moda",
    "domain": "casa.moda",
    "hostname": "dash.casa.moda"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68fbc84609098d17c316f23c",
      "name": "NSO - Multiple crimes",
      "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-24T18:41:10.936000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fc18514965ccd3b55c216d",
      "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
      "description": "",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-25T00:22:41.686000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68fbc84609098d17c316f23c",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687b5499d48de6e54f3bff11",
      "name": "213.174.130.70 - Spyware Install  | Emotet via Malware sites",
      "description": "Malicious IP address for multiple malware domains. Very malicious spyware, will hijack network and devices. \n\u2022 Best Targeted sites \nSpyware Install\n\u2022 Garveep POST CnC\nBeacon\n\u2022 Worm.Mydoom\nCheckin\n\n#endgame #emotet #mydoom #malware_domains #install_spyware #monitered_targets",
      "modified": "2025-08-18T08:00:43.712000",
      "created": "2025-07-19T08:17:29.443000",
      "tags": [
        "handle",
        "ripe ncc",
        "ripe network",
        "address range",
        "cidr",
        "allocation type",
        "assigned pa",
        "status",
        "whois server",
        "entity ah36ripe",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "cnsectigo rsa",
        "secure server",
        "ca validity",
        "date",
        "abuse contact",
        "orgid",
        "orgtechhandle",
        "address",
        "orgabuseref",
        "postalcode",
        "ripe",
        "seen",
        "update date",
        "tech email",
        "admin country",
        "expiration date",
        "dnssec",
        "admin id",
        "mi11255597wp",
        "msie",
        "chrome",
        "passive dns",
        "united",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "urls",
        "files",
        "hosting",
        "open",
        "body",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "anorexx",
        "video",
        "father sex",
        "ebony riding",
        "ebony",
        "roberta",
        "type win32",
        "exe size",
        "mb first",
        "file name",
        "sentinelone",
        "present jul",
        "present oct",
        "entries http",
        "memcommit",
        "t1055",
        "read c",
        "search",
        "entries",
        "show",
        "medium",
        "showing",
        "high process",
        "injection t1055",
        "copy",
        "write",
        "win32",
        "malware",
        "tsara brashears",
        "tsara",
        "pornhub",
        "porn videos",
        "watch tsara",
        "most relevant",
        "open threat",
        "exchange",
        "public",
        "https",
        "green",
        "daily",
        "brashears",
        "porn",
        "watch",
        "busty xxx",
        "filter tsara",
        "brashears porn",
        "url add",
        "pulse pulses",
        "http",
        "related pulses",
        "none related",
        "tags none",
        "file type",
        "md5 sha256",
        "google safe",
        "browsing",
        "dynamicloader",
        "dynamic",
        "read",
        "delete",
        "mtb apr",
        "trojan",
        "lowfi",
        "virtool",
        "icloader apr",
        "otx telemetry",
        "australia",
        "exploit",
        "cobalt strike",
        "hostile",
        "trojanspy",
        "msil",
        "win64",
        "pulse",
        "alerts",
        "yara rule",
        "named pipe",
        "xe7xf3xf2x14x9d",
        "high",
        "delphi",
        "local",
        "next",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "defense evasion",
        "adversaries",
        "spawns",
        "found",
        "process details",
        "flag",
        "contacted",
        "meta",
        "location united",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "size",
        "beginstring",
        "null",
        "type data",
        "error",
        "span",
        "hybrid",
        "general",
        "click",
        "strings",
        "refresh",
        "tools",
        "pattern match",
        "show technique",
        "mitre att",
        "ck matrix",
        "ascii text",
        "show process",
        "utf8",
        "crlf line",
        "network traffic",
        "path",
        "included",
        "review",
        "excludea",
        "sugges data",
        "typ url",
        "url url",
        "url hos",
        "hos hos",
        "extraction f",
        "enter so",
        "u extractio",
        "extra data",
        "included review",
        "ic excluded",
        "suggeste",
        "pulses",
        "md5 google",
        "safe browsing",
        "virustotal api",
        "comments",
        "ally s",
        "extraction data",
        "enter soudcfidi",
        "ad temdac",
        "cddad ad",
        "praw type",
        "extr",
        "include u",
        "creation date",
        "record value",
        "gmt content",
        "x adblock",
        "certificate",
        "domain",
        "encrypt",
        "sec ch",
        "ch ua",
        "unknown aaaa",
        "ua full",
        "ua platform",
        "present jun",
        "moved",
        "ip address",
        "doctype html",
        "lander script",
        "head",
        "method",
        "allowed date",
        "arizona",
        "scottsdale",
        "go daddy",
        "authority",
        "next associated",
        "extraction fail",
        "enter soupce",
        "udi ad",
        "trydda dada",
        "panca type",
        "ur extraction",
        "s data",
        "pr extract",
        "servers",
        "hostname",
        "files ip",
        "denmark unknown"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 4,
        "URL": 7528,
        "domain": 1822,
        "hostname": 2015,
        "email": 5,
        "FileHash-MD5": 373,
        "FileHash-SHA1": 363,
        "FileHash-SHA256": 1939
      },
      "indicator_count": 14049,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "244 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://dash.casa.moda/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://dash.casa.moda/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776616868.9850562
}