{
  "type": "URL",
  "indicator": "https://desertpoplar.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://desertpoplar.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3920647617,
      "indicator": "https://desertpoplar.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68e2bb5d9ee8577ab5519f2c",
          "name": "Meritshealth with DoD links? ",
          "description": "",
          "modified": "2026-01-13T00:05:56.401000",
          "created": "2025-10-05T18:39:25.286000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "68e2b14d83bb63502feac65e",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1365,
            "URL": 11172,
            "hostname": 2780,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4420,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 20486,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "97 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68e2b14d83bb63502feac65e",
          "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
          "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
          "modified": "2026-01-07T00:00:30.717000",
          "created": "2025-10-05T17:56:29.109000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1328,
            "URL": 9931,
            "hostname": 2621,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4360,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 18989,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "103 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68bc8015944465ffa1c03148",
          "name": "Security Affairs affecting Critical Infrastructure",
          "description": "Security affairs.com found in a State Policy & Financing website research due to social engineering &  insurance policies hacking scheme. \u2022 SecurityAffairs.com statement: The website specializes in cybersecurity and its related fields, providing insights into current threats and trends. \nContent:\nIt features news articles, investigative reports, and analyses from experts in the field. \nTopics:\nContent often includes discussions on:\ncybercrime,\ncybersecurity trends ,\nintelligence and geopolitics,\nemerging threats. (I can\u2019t verify because idk).\n\n(Auto populated: 335,923 out of 489,337 Fortinet firewalls vulnerable to CVE-2023-27997)\nAdversary auto populated: Suggested Adversaries:\nMember Ad-Hoc Working ADVERSARIES Group on Cyber Threat Landscapes, Ethical Hacker, Security Evangelist",
          "modified": "2025-10-06T18:03:15.359000",
          "created": "2025-09-06T18:40:21.276000",
          "tags": [
            "script urls",
            "security",
            "script domains",
            "ip address",
            "meta",
            "stealth window",
            "reads_self",
            "creates_largekey",
            "dynamic_function_loading",
            "script_created_process",
            "antivm_generic_disk",
            "ids",
            "infostealer_cookies",
            "infostealer_keylog",
            "custom malware",
            "suspicious_command_tools",
            "antisandbox_mouse_hook",
            "dynamicloader",
            "tlsv1",
            "ogoogle trust",
            "cngts ca",
            "tls handshake",
            "failure",
            "united",
            "high",
            "search",
            "write",
            "malware",
            "unknown",
            "extraction",
            "data upload",
            "extraction data",
            "enter soudae",
            "hdi ad",
            "temdac c",
            "extri",
            "include review",
            "trojandropper",
            "mtb jun",
            "passive dns",
            "files",
            "location united",
            "twitter",
            "exploit",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "pe32",
            "port",
            "destination",
            "present sep",
            "a domains",
            "creation date",
            "error",
            "title",
            "android",
            "known exploited",
            "google",
            "salesloft drift",
            "qantas",
            "july",
            "meetc2",
            "c2 framework",
            "google calendar",
            "apis",
            "critical",
            "rokrat",
            "windows",
            "tags none",
            "file type",
            "virustotal api",
            "screenshots",
            "comments",
            "learn",
            "suspicious",
            "informative",
            "adversaries",
            "ck id",
            "name tactics",
            "command",
            "defense evasion",
            "spawns",
            "t1590 gather",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "additional info",
            "yara signature",
            "unicode text",
            "utf8 text",
            "idat",
            "style",
            "defs",
            "command decode",
            "strings",
            "yxgbc",
            "core",
            "flag",
            "date",
            "markmonitor",
            "server",
            "automattic",
            "name server",
            "proxy",
            "llc name",
            "windir",
            "pattern match",
            "mitre att",
            "show technique",
            "ck matrix",
            "sha1",
            "show process",
            "hybrid",
            "general",
            "local",
            "path",
            "encrypt",
            "form",
            "iframe",
            "click",
            "server response",
            "google safe",
            "results aug",
            "affairs",
            "founder",
            "cybhorus",
            "cybaze",
            "member adhoc",
            "working group",
            "cyber threat",
            "landscapes",
            "ethical hacker",
            "hoc working",
            "ssl certificate",
            "initial access",
            "href",
            "ascii text"
          ],
          "references": [
            "https://securityaffairs.com/",
            "/181480/cyber-crime/iot-under-siege-the-return-of-the-mirai-based-gayfemboy-botnet.html",
            "https://securityaffairs.com/106770/deep-web/ubereats-data-leaked-dark-web.html",
            "https://securityaffairs.com/107190/data-breach/sodinokibi-ransomware-brown-forman.html",
            "https://securityaffairs.com/115693/apt/chinese-hackers-5g.html",
            "https://securityaffairs.com/109224/data-breach/food-delivery-service-chowbus-hack.html",
            "https://securityaffairs.com/112637/cyber-crime/the-hospital-group-revil.html",
            "https://securityaffairs.com/139472/data-breach/commonspirit-data-breach-623k-patients.html",
            "https://securityaffairs.com/148110/hackinq/fortinet-fortios-vulnerable-devices-online.html",
            "https://securityaffairs.com/148110/hackinq/fortinet-fortios-vulnerable-devices-online.html",
            "Multiple other undocumented malware"
          ],
          "public": 1,
          "adversary": "Hoc Working",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "!#AddsCopyToStartup",
              "display_name": "!#AddsCopyToStartup",
              "target": null
            },
            {
              "id": "!#LowFiWriteMZInUnusualExtension",
              "display_name": "!#LowFiWriteMZInUnusualExtension",
              "target": null
            },
            {
              "id": "Trojan:Win32/QQpass",
              "display_name": "Trojan:Win32/QQpass",
              "target": "/malware/Trojan:Win32/QQpass"
            },
            {
              "id": "\"prepending (enc) ransomware\" (Not an official name)",
              "display_name": "\"prepending (enc) ransomware\" (Not an official name)",
              "target": null
            },
            {
              "id": ".A ,  ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn",
              "display_name": ".A ,  ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn",
              "target": null
            },
            {
              "id": "PWS:Win32/Ymacco.AA50",
              "display_name": "PWS:Win32/Ymacco.AA50",
              "target": "/malware/PWS:Win32/Ymacco.AA50"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Salgorea!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Salgorea!rfn",
              "target": null
            },
            {
              "id": "CVE-2025-42957",
              "display_name": "CVE-2025-42957",
              "target": null
            },
            {
              "id": "CVE-2023-27997",
              "display_name": "CVE-2023-27997",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [
            "Government",
            "Manufacturing",
            "Critical Infrastructure"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 187,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 1140,
            "URL": 1258,
            "domain": 237,
            "email": 1,
            "hostname": 470,
            "SSLCertFingerprint": 17,
            "CVE": 3
          },
          "indicator_count": 3465,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "195 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6694bb9be1b61bf820500004",
          "name": "YouTube Creator Cyber Attacks | Jays Youtube Bot.exe | YT Botnet",
          "description": "YouTube Creator account attacks. Critical alerts, botnets, YT bots. I cannot adequately describe  attack right now.  Retaliation for targets YT channel Song Culture stems from retaliation shortly after a crime against target. Id be interested to learn more. An ITC Intercepter records traffic passed through Song Culture YouTube channel m redirects to other channels. Not reflected in the 1.5 million followers or the 3.2 million views. They just stopped. Then managing director was notified as all of Song Cultures social media Twitter, Instagram, Pinterest succumbed to Emotet attack. Social engineering did occur. Several parties. Alleged eBay , health insurance representatives, an attorney, alleged PI's music managers contacted by phone. A man from Great Britain also began an SE campaign, The strange part is following, confrontations, dangerous attacks, MIB, and other curious in person encounter, critical injuries, financial devastation has caused target to remain isolated.",
          "modified": "2024-08-14T05:03:59.815000",
          "created": "2024-07-15T06:03:07.423000",
          "tags": [
            "historical ssl",
            "referrer",
            "december",
            "sneaky server",
            "replacement",
            "unauthorized",
            "high level",
            "hackers",
            "highly targeted",
            "cyber attack",
            "emotet",
            "critical",
            "copy",
            "united",
            "command decode",
            "suricata ipv4",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "sha1",
            "name server",
            "date",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "song culture",
            "tsara lynn",
            "culture",
            "chime sa",
            "mediawarning",
            "youtube twitter",
            "secchuabitness",
            "secchuamodel",
            "secchuawow64",
            "secchuaplatform",
            "pragma",
            "form",
            "hope",
            "karma",
            "learn",
            "suspicious",
            "flag",
            "pe resource",
            "synaptics",
            "apeaksoft ios",
            "hiddentear",
            "urls",
            "domains",
            "contacted",
            "markmonitor",
            "win32 exe",
            "parents",
            "type name",
            "msrsaapp",
            "youtube bot",
            "rar jays",
            "mozilla firefox",
            "twitch",
            "samplename",
            "rar youtube",
            "zip youtube",
            "social bots",
            "files",
            "file type",
            "kb file",
            "b file",
            "graph",
            "get https",
            "msie",
            "windows nt",
            "win64",
            "slcc2",
            "media center",
            "request",
            "gmt server",
            "referer https",
            "amd64 accept",
            "accept",
            "code",
            "rwx memory",
            "managed code",
            "calls unmanaged",
            "native",
            "often seen",
            "base64 encrypt",
            "trojan",
            "tsara brashears",
            "red team hacking",
            "process32nextw",
            "regsetvalueexa",
            "regdword",
            "high",
            "medium",
            "objects",
            "regbinary",
            "module load",
            "t1129",
            "t1060",
            "crash",
            "dock",
            "persistence",
            "execution",
            "okhfjrtblzo",
            "ip check",
            "windows",
            "http host",
            "controlservice",
            "domain",
            "registry",
            "tools",
            "service",
            "worm",
            "malware",
            "win32",
            "bits",
            "read c",
            "intel",
            "ms windows",
            "pe32",
            "search",
            "type read",
            "show",
            "wow64",
            "stop",
            "write",
            "unknown",
            "waiting",
            "push",
            "next",
            "asnone united",
            "aaaa",
            "united kingdom",
            "as20738 host",
            "moved",
            "passive dns",
            "default",
            "delete c",
            "pe32 executable",
            "document file",
            "v2 document",
            "floodfix",
            "floxif",
            "name servers",
            "susp",
            "showing",
            "as55286",
            "scan endpoints",
            "all scoreblue",
            "ransom",
            "amadey",
            "songculture",
            "spreader",
            "tracey richter",
            "roberts",
            "michael roberts",
            "jays",
            "sabey",
            "rexxfield",
            "darklivity"
          ],
          "references": [
            "https://www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Jays Youtube Bot.exe",
            "https://www.virustotal.com/gui/url/b766d444d21c2ad2d777ae4a5ef7b7b7b97f2097805732e9651834e0a76be1f4/details",
            "Jays Youtube Bot.exe > FileHash-SHA256\t00514527e00ee001d042",
            "Matches rule DotNet_Reactor from ruleset DotNet_Reactor by @bartblaze",
            "https://www.virustotal.com/gui/file/00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5/detection",
            "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "http://freedns.afraid.org/subdomain/edit.php?data_id=21091713",
            "Ransom: message.htm.com",
            "Antivirus Detections: Win.Virus.Pioneer-9111434-0 ,  Virus:Win32/Floxif.H | IDS Detections: Win32.Floxif.A Checkin 403 Forbidden",
            "Yara Detections: stack_string ,  KERNEL32_DLL_xor_exe_key_197 ,  xor_0xc5_This_program",
            "Alerts: dead_host network_icmp nolookup_communication persistence_autorun installs_bho",
            "Alerts: modifies_proxy_wpad multiple_useragents injection_resumethread antivm_vmware_in_instruction",
            "Alerts: dumped_buffer network_cnc_http network_http allocates_rwx applcation_raises_exception",
            "Alerts: infostealer_browser creates_exe suspicious_process modifies_certificates stealth_window exe_appdata",
            "Antivirus Detections: Win32:Renos-KY\\ [Trj] ,  Win.Worm.Pykspa-6057105-0 ,  Worm:Win32/Pykspa.C IDS Detections Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host) IP Check Domain (showmyipaddress .com in HTTP Host) IP Check Domain (whatismyipaddress .com in HTTP Host) 403 Forbidden Yara Detections None Alerts network_icmp disables_security antiav_servicestop antisandbox_sleep persistence_autorun modify_uac_prompt antivm_vmware_in_instruction network_http recon_checkip creates_exe create",
            "Win32:Renos-KY\\ [Trj] , Win.Worm.Pykspa , Worm:Win32/Pykspa.C: FileHash-SHA256 0000294999c616c2dc6722880830752e826f2c11719c926ef3e62f7b0ef1e0bd trojan",
            "https://otx.alienvault.com/indicator/file/0000294999c616c2dc6722880830752e826f2c11719c926ef3e62f7b0ef1e0bd",
            "Jays Youtube Bot.exe | **http://ur.now.afraid.org/update/bft.exe | https://avsono.com/networkmanager/ | http://fatah.afraid.org/files/books/Embedded.Linux.Programming.pdf",
            "https://otx.alienvault.com/indicator/file/da06b3d7e20045b6edad50f28ce8bac1",
            "FileHash-MD5 da06b3d7e20045b6edad50f28ce8bac1",
            "Antivirus Detections: Win.Virus.Pioneer-9111434-0 ,  Virus:Win32/Floxif.H",
            "IDS Detections: Win32.Floxif.A Checkin 403 Forbidden |   |",
            "Yara Detections: stack_string ,  KERNEL32_DLL_xor_exe_key_197 ,  xor_0xc5_This_program",
            "Alerts: dead_host network_icmp nolookup_communication persistence_autorun installs_bho modifies_certificates",
            "Alerts: modifies_proxy_wpad multiple_useragents injection_resumethread antivm_vmware_in_instruction",
            "Alerts: dumped_buffer network_cnc_http network_http allocates_rwx applcation_raises_exception infostealer_browser",
            "Alerts: stealth_windowcreates_exe suspicious_process exe_appdata",
            "http://jofu93hf9fdsl.canadacaregiverconsulting.com/pclianyeapp/1167.jpg [Tsara Brashears > Song Culture & Samantha Borrego> dorkingbeaty]",
            "https://otx.alienvault.com/indicator/url/http://jofu93hf9fdsl.canadacaregiverconsulting.com/pclianyeapp/1167.jpg",
            "https://otx.alienvault.com/indicator/url/https://my.newzapp.co.uk/t/click/1684555348/129495091/17547390 [Target:SongCulture/Tsara Brashears YT]",
            "Related somehow, pulse modified by?https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
            "http://ur.now.afraid.org/update/bft.exe (Joshua Anderson Address 4120 Douglas Blvd #306-199 City\tGranite Bay Country US ?)",
            "https://otx.alienvault.com/indicator/domain/mywebsitetransfer.com [really?]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Backdoor.Xtreme",
              "display_name": "Backdoor.Xtreme",
              "target": null
            },
            {
              "id": "W32.AIDetectMalware.CS",
              "display_name": "W32.AIDetectMalware.CS",
              "target": null
            },
            {
              "id": "Win.Virus.Pioneer-9111434-0",
              "display_name": "Win.Virus.Pioneer-9111434-0",
              "target": null
            },
            {
              "id": "Virus:Win32/Floxif.H",
              "display_name": "Virus:Win32/Floxif.H",
              "target": "/malware/Virus:Win32/Floxif.H"
            },
            {
              "id": "Win32:Renos-KY\\ [Trj]",
              "display_name": "Win32:Renos-KY\\ [Trj]",
              "target": null
            },
            {
              "id": ",  Win.Worm.Pykspa-6057105-0",
              "display_name": ",  Win.Worm.Pykspa-6057105-0",
              "target": null
            },
            {
              "id": "Worm:Win32/Pykspa.C",
              "display_name": "Worm:Win32/Pykspa.C",
              "target": "/malware/Worm:Win32/Pykspa.C"
            },
            {
              "id": "PUP/Hacktool",
              "display_name": "PUP/Hacktool",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1088",
              "name": "Bypass User Account Control",
              "display_name": "T1088 - Bypass User Account Control"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 439,
            "FileHash-SHA1": 386,
            "FileHash-SHA256": 2320,
            "URL": 1873,
            "domain": 478,
            "hostname": 839,
            "SSLCertFingerprint": 9,
            "email": 7
          },
          "indicator_count": 6351,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "614 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6692cf0e2273bb06aa43e43c",
          "name": "Banker: Through The Nights - YouTube | Errors |",
          "description": "YouTube creator issue. Hijacked channel. Won't open in  VT, 303 error, ransomware files. Ransomware confirmed, limited access/research for today's pulse.",
          "modified": "2024-08-12T18:02:56.458000",
          "created": "2024-07-13T19:01:34.484000",
          "tags": [
            "united",
            "command decode",
            "suricata ipv4",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "sha1",
            "name server",
            "date",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "low risk",
            "domain",
            "no malware",
            "found",
            "site",
            "ip address",
            "google network",
            "unknown",
            "low security",
            "risk",
            "hacked",
            "protect",
            "path",
            "secure",
            "httponly",
            "secchuabitness",
            "secchuamodel",
            "secchuawow64",
            "secchuaplatform",
            "samesitenone",
            "http response",
            "final url",
            "status code",
            "body length",
            "kb body",
            "pragma",
            "song culture",
            "tsara lynn",
            "culture",
            "chime sa",
            "mediawarning",
            "youtube twitter",
            "jess",
            "tsara brashears",
            "zafira songs",
            "youtube og",
            "hope",
            "html info",
            "meta tags",
            "data",
            "v3 serial",
            "number",
            "cus ogoogle",
            "trust",
            "llc cngts",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "name",
            "whois lookup",
            "create date",
            "expiry date",
            "query time",
            "update date",
            "update",
            "passive dns",
            "gmt content",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "urls",
            "files",
            "related pulses",
            "error",
            "code",
            "algorithm",
            "first"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 343,
            "SSLCertFingerprint": 8,
            "URL": 333,
            "domain": 69,
            "hostname": 165
          },
          "indicator_count": 924,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "615 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "https://otx.alienvault.com/indicator/domain/mywebsitetransfer.com [really?]",
        "http://ur.now.afraid.org/update/bft.exe (Joshua Anderson Address 4120 Douglas Blvd #306-199 City\tGranite Bay Country US ?)",
        "If someone is believed to be a threat they have right to due process.",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "Antivirus Detections: Win.Virus.Pioneer-9111434-0 ,  Virus:Win32/Floxif.H | IDS Detections: Win32.Floxif.A Checkin 403 Forbidden",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "FileHash-MD5 da06b3d7e20045b6edad50f28ce8bac1",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "https://securityaffairs.com/148110/hackinq/fortinet-fortios-vulnerable-devices-online.html",
        "Win32:Renos-KY\\ [Trj] , Win.Worm.Pykspa , Worm:Win32/Pykspa.C: FileHash-SHA256 0000294999c616c2dc6722880830752e826f2c11719c926ef3e62f7b0ef1e0bd trojan",
        "https://es.pornhat.com/models/the-sex-creator/",
        "https://securityaffairs.com/112637/cyber-crime/the-hospital-group-revil.html",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Jays Youtube Bot.exe | **http://ur.now.afraid.org/update/bft.exe | https://avsono.com/networkmanager/ | http://fatah.afraid.org/files/books/Embedded.Linux.Programming.pdf",
        "https://otx.alienvault.com/indicator/file/da06b3d7e20045b6edad50f28ce8bac1",
        "https://otx.alienvault.com/indicator/file/0000294999c616c2dc6722880830752e826f2c11719c926ef3e62f7b0ef1e0bd",
        "Alerts: dead_host network_icmp nolookup_communication persistence_autorun installs_bho modifies_certificates",
        "Alerts: infostealer_browser creates_exe suspicious_process modifies_certificates stealth_window exe_appdata",
        "https://securityaffairs.com/",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "Alerts: modifies_proxy_wpad multiple_useragents injection_resumethread antivm_vmware_in_instruction",
        "There is fear in silence or speaking out",
        "Antivirus Detections: Win32:Renos-KY\\ [Trj] ,  Win.Worm.Pykspa-6057105-0 ,  Worm:Win32/Pykspa.C IDS Detections Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host) IP Check Domain (showmyipaddress .com in HTTP Host) IP Check Domain (whatismyipaddress .com in HTTP Host) 403 Forbidden Yara Detections None Alerts network_icmp disables_security antiav_servicestop antisandbox_sleep persistence_autorun modify_uac_prompt antivm_vmware_in_instruction network_http recon_checkip creates_exe create",
        "iamrobert.com Y.A.S.",
        "Multiple other undocumented malware",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "Alerts: dumped_buffer network_cnc_http network_http allocates_rwx applcation_raises_exception",
        "Yara Detections: stack_string ,  KERNEL32_DLL_xor_exe_key_197 ,  xor_0xc5_This_program",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://www.virustotal.com/gui/url/b766d444d21c2ad2d777ae4a5ef7b7b7b97f2097805732e9651834e0a76be1f4/details",
        "Alerts: stealth_windowcreates_exe suspicious_process exe_appdata",
        "https://meumundogay-com.sexogratis.page/locker",
        "I am very upset. Whoever is doing this is sick.",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://securityaffairs.com/139472/data-breach/commonspirit-data-breach-623k-patients.html",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "IDS Detections: Win32.Floxif.A Checkin 403 Forbidden |   |",
        "https://www.virustotal.com/gui/file/00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5/detection",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "https://securityaffairs.com/115693/apt/chinese-hackers-5g.html",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "Jays Youtube Bot.exe > FileHash-SHA256\t00514527e00ee001d042",
        "http://jofu93hf9fdsl.canadacaregiverconsulting.com/pclianyeapp/1167.jpg [Tsara Brashears > Song Culture & Samantha Borrego> dorkingbeaty]",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "Can the DoD no questions asked target a SA victim",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "https://otx.alienvault.com/indicator/url/https://my.newzapp.co.uk/t/click/1684555348/129495091/17547390 [Target:SongCulture/Tsara Brashears YT]",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Antivirus Detections: Win.Virus.Pioneer-9111434-0 ,  Virus:Win32/Floxif.H",
        "/181480/cyber-crime/iot-under-siege-the-return-of-the-mirai-based-gayfemboy-botnet.html",
        "https://otx.alienvault.com/indicator/url/http://jofu93hf9fdsl.canadacaregiverconsulting.com/pclianyeapp/1167.jpg",
        "https://securityaffairs.com/107190/data-breach/sodinokibi-ransomware-brown-forman.html",
        "https://www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Jays Youtube Bot.exe",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "Alerts: dead_host network_icmp nolookup_communication persistence_autorun installs_bho",
        "Ransom: message.htm.com",
        "Related somehow, pulse modified by?https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "Alerts: dumped_buffer network_cnc_http network_http allocates_rwx applcation_raises_exception infostealer_browser",
        "Target agreed and complied with all lie detector measures.",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "Matches rule DotNet_Reactor from ruleset DotNet_Reactor by @bartblaze",
        "https://securityaffairs.com/109224/data-breach/food-delivery-service-chowbus-hack.html",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://securityaffairs.com/106770/deep-web/ubereats-data-leaked-dark-web.html",
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "http://freedns.afraid.org/subdomain/edit.php?data_id=21091713"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Hoc Working"
          ],
          "malware_families": [
            "Worm:win32/pykspa.c",
            "Pws:win32/ymacco.aa50",
            "Alf:heraklezeval:trojan:win32/salgorea!rfn",
            "\"prepending (enc) ransomware\" (not an official name)",
            ",  win.worm.pykspa-6057105-0",
            "Trojan:win32/qqpass",
            "Apnic",
            "Backdoor.xtreme",
            "Win32:renos-ky\\ [trj]",
            "W32.aidetectmalware.cs",
            "!#addscopytostartup",
            "Emotet",
            "Pup/hacktool",
            "Cve-2025-42957",
            "Win.virus.pioneer-9111434-0",
            ".a ,  alf:heraklezeval:pws:win32/ldpinch!rfn",
            "Cve-2023-27997",
            "Virus:win32/floxif.h",
            "!#lowfiwritemzinunusualextension",
            "Malware"
          ],
          "industries": [
            "Critical infrastructure",
            "Government",
            "Manufacturing"
          ],
          "unique_indicators": 28752
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/desertpoplar.com",
    "whois": "http://whois.domaintools.com/desertpoplar.com",
    "domain": "desertpoplar.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68e2bb5d9ee8577ab5519f2c",
      "name": "Meritshealth with DoD links? ",
      "description": "",
      "modified": "2026-01-13T00:05:56.401000",
      "created": "2025-10-05T18:39:25.286000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "68e2b14d83bb63502feac65e",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1365,
        "URL": 11172,
        "hostname": 2780,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4420,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 20486,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "97 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68e2b14d83bb63502feac65e",
      "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
      "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
      "modified": "2026-01-07T00:00:30.717000",
      "created": "2025-10-05T17:56:29.109000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1328,
        "URL": 9931,
        "hostname": 2621,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4360,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 18989,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "103 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68bc8015944465ffa1c03148",
      "name": "Security Affairs affecting Critical Infrastructure",
      "description": "Security affairs.com found in a State Policy & Financing website research due to social engineering &  insurance policies hacking scheme. \u2022 SecurityAffairs.com statement: The website specializes in cybersecurity and its related fields, providing insights into current threats and trends. \nContent:\nIt features news articles, investigative reports, and analyses from experts in the field. \nTopics:\nContent often includes discussions on:\ncybercrime,\ncybersecurity trends ,\nintelligence and geopolitics,\nemerging threats. (I can\u2019t verify because idk).\n\n(Auto populated: 335,923 out of 489,337 Fortinet firewalls vulnerable to CVE-2023-27997)\nAdversary auto populated: Suggested Adversaries:\nMember Ad-Hoc Working ADVERSARIES Group on Cyber Threat Landscapes, Ethical Hacker, Security Evangelist",
      "modified": "2025-10-06T18:03:15.359000",
      "created": "2025-09-06T18:40:21.276000",
      "tags": [
        "script urls",
        "security",
        "script domains",
        "ip address",
        "meta",
        "stealth window",
        "reads_self",
        "creates_largekey",
        "dynamic_function_loading",
        "script_created_process",
        "antivm_generic_disk",
        "ids",
        "infostealer_cookies",
        "infostealer_keylog",
        "custom malware",
        "suspicious_command_tools",
        "antisandbox_mouse_hook",
        "dynamicloader",
        "tlsv1",
        "ogoogle trust",
        "cngts ca",
        "tls handshake",
        "failure",
        "united",
        "high",
        "search",
        "write",
        "malware",
        "unknown",
        "extraction",
        "data upload",
        "extraction data",
        "enter soudae",
        "hdi ad",
        "temdac c",
        "extri",
        "include review",
        "trojandropper",
        "mtb jun",
        "passive dns",
        "files",
        "location united",
        "twitter",
        "exploit",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "pe32",
        "port",
        "destination",
        "present sep",
        "a domains",
        "creation date",
        "error",
        "title",
        "android",
        "known exploited",
        "google",
        "salesloft drift",
        "qantas",
        "july",
        "meetc2",
        "c2 framework",
        "google calendar",
        "apis",
        "critical",
        "rokrat",
        "windows",
        "tags none",
        "file type",
        "virustotal api",
        "screenshots",
        "comments",
        "learn",
        "suspicious",
        "informative",
        "adversaries",
        "ck id",
        "name tactics",
        "command",
        "defense evasion",
        "spawns",
        "t1590 gather",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "additional info",
        "yara signature",
        "unicode text",
        "utf8 text",
        "idat",
        "style",
        "defs",
        "command decode",
        "strings",
        "yxgbc",
        "core",
        "flag",
        "date",
        "markmonitor",
        "server",
        "automattic",
        "name server",
        "proxy",
        "llc name",
        "windir",
        "pattern match",
        "mitre att",
        "show technique",
        "ck matrix",
        "sha1",
        "show process",
        "hybrid",
        "general",
        "local",
        "path",
        "encrypt",
        "form",
        "iframe",
        "click",
        "server response",
        "google safe",
        "results aug",
        "affairs",
        "founder",
        "cybhorus",
        "cybaze",
        "member adhoc",
        "working group",
        "cyber threat",
        "landscapes",
        "ethical hacker",
        "hoc working",
        "ssl certificate",
        "initial access",
        "href",
        "ascii text"
      ],
      "references": [
        "https://securityaffairs.com/",
        "/181480/cyber-crime/iot-under-siege-the-return-of-the-mirai-based-gayfemboy-botnet.html",
        "https://securityaffairs.com/106770/deep-web/ubereats-data-leaked-dark-web.html",
        "https://securityaffairs.com/107190/data-breach/sodinokibi-ransomware-brown-forman.html",
        "https://securityaffairs.com/115693/apt/chinese-hackers-5g.html",
        "https://securityaffairs.com/109224/data-breach/food-delivery-service-chowbus-hack.html",
        "https://securityaffairs.com/112637/cyber-crime/the-hospital-group-revil.html",
        "https://securityaffairs.com/139472/data-breach/commonspirit-data-breach-623k-patients.html",
        "https://securityaffairs.com/148110/hackinq/fortinet-fortios-vulnerable-devices-online.html",
        "https://securityaffairs.com/148110/hackinq/fortinet-fortios-vulnerable-devices-online.html",
        "Multiple other undocumented malware"
      ],
      "public": 1,
      "adversary": "Hoc Working",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "!#AddsCopyToStartup",
          "display_name": "!#AddsCopyToStartup",
          "target": null
        },
        {
          "id": "!#LowFiWriteMZInUnusualExtension",
          "display_name": "!#LowFiWriteMZInUnusualExtension",
          "target": null
        },
        {
          "id": "Trojan:Win32/QQpass",
          "display_name": "Trojan:Win32/QQpass",
          "target": "/malware/Trojan:Win32/QQpass"
        },
        {
          "id": "\"prepending (enc) ransomware\" (Not an official name)",
          "display_name": "\"prepending (enc) ransomware\" (Not an official name)",
          "target": null
        },
        {
          "id": ".A ,  ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn",
          "display_name": ".A ,  ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn",
          "target": null
        },
        {
          "id": "PWS:Win32/Ymacco.AA50",
          "display_name": "PWS:Win32/Ymacco.AA50",
          "target": "/malware/PWS:Win32/Ymacco.AA50"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Salgorea!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Salgorea!rfn",
          "target": null
        },
        {
          "id": "CVE-2025-42957",
          "display_name": "CVE-2025-42957",
          "target": null
        },
        {
          "id": "CVE-2023-27997",
          "display_name": "CVE-2023-27997",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [
        "Government",
        "Manufacturing",
        "Critical Infrastructure"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 187,
        "FileHash-SHA1": 152,
        "FileHash-SHA256": 1140,
        "URL": 1258,
        "domain": 237,
        "email": 1,
        "hostname": 470,
        "SSLCertFingerprint": 17,
        "CVE": 3
      },
      "indicator_count": 3465,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "195 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6694bb9be1b61bf820500004",
      "name": "YouTube Creator Cyber Attacks | Jays Youtube Bot.exe | YT Botnet",
      "description": "YouTube Creator account attacks. Critical alerts, botnets, YT bots. I cannot adequately describe  attack right now.  Retaliation for targets YT channel Song Culture stems from retaliation shortly after a crime against target. Id be interested to learn more. An ITC Intercepter records traffic passed through Song Culture YouTube channel m redirects to other channels. Not reflected in the 1.5 million followers or the 3.2 million views. They just stopped. Then managing director was notified as all of Song Cultures social media Twitter, Instagram, Pinterest succumbed to Emotet attack. Social engineering did occur. Several parties. Alleged eBay , health insurance representatives, an attorney, alleged PI's music managers contacted by phone. A man from Great Britain also began an SE campaign, The strange part is following, confrontations, dangerous attacks, MIB, and other curious in person encounter, critical injuries, financial devastation has caused target to remain isolated.",
      "modified": "2024-08-14T05:03:59.815000",
      "created": "2024-07-15T06:03:07.423000",
      "tags": [
        "historical ssl",
        "referrer",
        "december",
        "sneaky server",
        "replacement",
        "unauthorized",
        "high level",
        "hackers",
        "highly targeted",
        "cyber attack",
        "emotet",
        "critical",
        "copy",
        "united",
        "command decode",
        "suricata ipv4",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "sha1",
        "name server",
        "date",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "song culture",
        "tsara lynn",
        "culture",
        "chime sa",
        "mediawarning",
        "youtube twitter",
        "secchuabitness",
        "secchuamodel",
        "secchuawow64",
        "secchuaplatform",
        "pragma",
        "form",
        "hope",
        "karma",
        "learn",
        "suspicious",
        "flag",
        "pe resource",
        "synaptics",
        "apeaksoft ios",
        "hiddentear",
        "urls",
        "domains",
        "contacted",
        "markmonitor",
        "win32 exe",
        "parents",
        "type name",
        "msrsaapp",
        "youtube bot",
        "rar jays",
        "mozilla firefox",
        "twitch",
        "samplename",
        "rar youtube",
        "zip youtube",
        "social bots",
        "files",
        "file type",
        "kb file",
        "b file",
        "graph",
        "get https",
        "msie",
        "windows nt",
        "win64",
        "slcc2",
        "media center",
        "request",
        "gmt server",
        "referer https",
        "amd64 accept",
        "accept",
        "code",
        "rwx memory",
        "managed code",
        "calls unmanaged",
        "native",
        "often seen",
        "base64 encrypt",
        "trojan",
        "tsara brashears",
        "red team hacking",
        "process32nextw",
        "regsetvalueexa",
        "regdword",
        "high",
        "medium",
        "objects",
        "regbinary",
        "module load",
        "t1129",
        "t1060",
        "crash",
        "dock",
        "persistence",
        "execution",
        "okhfjrtblzo",
        "ip check",
        "windows",
        "http host",
        "controlservice",
        "domain",
        "registry",
        "tools",
        "service",
        "worm",
        "malware",
        "win32",
        "bits",
        "read c",
        "intel",
        "ms windows",
        "pe32",
        "search",
        "type read",
        "show",
        "wow64",
        "stop",
        "write",
        "unknown",
        "waiting",
        "push",
        "next",
        "asnone united",
        "aaaa",
        "united kingdom",
        "as20738 host",
        "moved",
        "passive dns",
        "default",
        "delete c",
        "pe32 executable",
        "document file",
        "v2 document",
        "floodfix",
        "floxif",
        "name servers",
        "susp",
        "showing",
        "as55286",
        "scan endpoints",
        "all scoreblue",
        "ransom",
        "amadey",
        "songculture",
        "spreader",
        "tracey richter",
        "roberts",
        "michael roberts",
        "jays",
        "sabey",
        "rexxfield",
        "darklivity"
      ],
      "references": [
        "https://www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Jays Youtube Bot.exe",
        "https://www.virustotal.com/gui/url/b766d444d21c2ad2d777ae4a5ef7b7b7b97f2097805732e9651834e0a76be1f4/details",
        "Jays Youtube Bot.exe > FileHash-SHA256\t00514527e00ee001d042",
        "Matches rule DotNet_Reactor from ruleset DotNet_Reactor by @bartblaze",
        "https://www.virustotal.com/gui/file/00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5/detection",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "http://freedns.afraid.org/subdomain/edit.php?data_id=21091713",
        "Ransom: message.htm.com",
        "Antivirus Detections: Win.Virus.Pioneer-9111434-0 ,  Virus:Win32/Floxif.H | IDS Detections: Win32.Floxif.A Checkin 403 Forbidden",
        "Yara Detections: stack_string ,  KERNEL32_DLL_xor_exe_key_197 ,  xor_0xc5_This_program",
        "Alerts: dead_host network_icmp nolookup_communication persistence_autorun installs_bho",
        "Alerts: modifies_proxy_wpad multiple_useragents injection_resumethread antivm_vmware_in_instruction",
        "Alerts: dumped_buffer network_cnc_http network_http allocates_rwx applcation_raises_exception",
        "Alerts: infostealer_browser creates_exe suspicious_process modifies_certificates stealth_window exe_appdata",
        "Antivirus Detections: Win32:Renos-KY\\ [Trj] ,  Win.Worm.Pykspa-6057105-0 ,  Worm:Win32/Pykspa.C IDS Detections Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host) IP Check Domain (showmyipaddress .com in HTTP Host) IP Check Domain (whatismyipaddress .com in HTTP Host) 403 Forbidden Yara Detections None Alerts network_icmp disables_security antiav_servicestop antisandbox_sleep persistence_autorun modify_uac_prompt antivm_vmware_in_instruction network_http recon_checkip creates_exe create",
        "Win32:Renos-KY\\ [Trj] , Win.Worm.Pykspa , Worm:Win32/Pykspa.C: FileHash-SHA256 0000294999c616c2dc6722880830752e826f2c11719c926ef3e62f7b0ef1e0bd trojan",
        "https://otx.alienvault.com/indicator/file/0000294999c616c2dc6722880830752e826f2c11719c926ef3e62f7b0ef1e0bd",
        "Jays Youtube Bot.exe | **http://ur.now.afraid.org/update/bft.exe | https://avsono.com/networkmanager/ | http://fatah.afraid.org/files/books/Embedded.Linux.Programming.pdf",
        "https://otx.alienvault.com/indicator/file/da06b3d7e20045b6edad50f28ce8bac1",
        "FileHash-MD5 da06b3d7e20045b6edad50f28ce8bac1",
        "Antivirus Detections: Win.Virus.Pioneer-9111434-0 ,  Virus:Win32/Floxif.H",
        "IDS Detections: Win32.Floxif.A Checkin 403 Forbidden |   |",
        "Yara Detections: stack_string ,  KERNEL32_DLL_xor_exe_key_197 ,  xor_0xc5_This_program",
        "Alerts: dead_host network_icmp nolookup_communication persistence_autorun installs_bho modifies_certificates",
        "Alerts: modifies_proxy_wpad multiple_useragents injection_resumethread antivm_vmware_in_instruction",
        "Alerts: dumped_buffer network_cnc_http network_http allocates_rwx applcation_raises_exception infostealer_browser",
        "Alerts: stealth_windowcreates_exe suspicious_process exe_appdata",
        "http://jofu93hf9fdsl.canadacaregiverconsulting.com/pclianyeapp/1167.jpg [Tsara Brashears > Song Culture & Samantha Borrego> dorkingbeaty]",
        "https://otx.alienvault.com/indicator/url/http://jofu93hf9fdsl.canadacaregiverconsulting.com/pclianyeapp/1167.jpg",
        "https://otx.alienvault.com/indicator/url/https://my.newzapp.co.uk/t/click/1684555348/129495091/17547390 [Target:SongCulture/Tsara Brashears YT]",
        "Related somehow, pulse modified by?https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "http://ur.now.afraid.org/update/bft.exe (Joshua Anderson Address 4120 Douglas Blvd #306-199 City\tGranite Bay Country US ?)",
        "https://otx.alienvault.com/indicator/domain/mywebsitetransfer.com [really?]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Backdoor.Xtreme",
          "display_name": "Backdoor.Xtreme",
          "target": null
        },
        {
          "id": "W32.AIDetectMalware.CS",
          "display_name": "W32.AIDetectMalware.CS",
          "target": null
        },
        {
          "id": "Win.Virus.Pioneer-9111434-0",
          "display_name": "Win.Virus.Pioneer-9111434-0",
          "target": null
        },
        {
          "id": "Virus:Win32/Floxif.H",
          "display_name": "Virus:Win32/Floxif.H",
          "target": "/malware/Virus:Win32/Floxif.H"
        },
        {
          "id": "Win32:Renos-KY\\ [Trj]",
          "display_name": "Win32:Renos-KY\\ [Trj]",
          "target": null
        },
        {
          "id": ",  Win.Worm.Pykspa-6057105-0",
          "display_name": ",  Win.Worm.Pykspa-6057105-0",
          "target": null
        },
        {
          "id": "Worm:Win32/Pykspa.C",
          "display_name": "Worm:Win32/Pykspa.C",
          "target": "/malware/Worm:Win32/Pykspa.C"
        },
        {
          "id": "PUP/Hacktool",
          "display_name": "PUP/Hacktool",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1088",
          "name": "Bypass User Account Control",
          "display_name": "T1088 - Bypass User Account Control"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 439,
        "FileHash-SHA1": 386,
        "FileHash-SHA256": 2320,
        "URL": 1873,
        "domain": 478,
        "hostname": 839,
        "SSLCertFingerprint": 9,
        "email": 7
      },
      "indicator_count": 6351,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "614 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6692cf0e2273bb06aa43e43c",
      "name": "Banker: Through The Nights - YouTube | Errors |",
      "description": "YouTube creator issue. Hijacked channel. Won't open in  VT, 303 error, ransomware files. Ransomware confirmed, limited access/research for today's pulse.",
      "modified": "2024-08-12T18:02:56.458000",
      "created": "2024-07-13T19:01:34.484000",
      "tags": [
        "united",
        "command decode",
        "suricata ipv4",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "sha1",
        "name server",
        "date",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "low risk",
        "domain",
        "no malware",
        "found",
        "site",
        "ip address",
        "google network",
        "unknown",
        "low security",
        "risk",
        "hacked",
        "protect",
        "path",
        "secure",
        "httponly",
        "secchuabitness",
        "secchuamodel",
        "secchuawow64",
        "secchuaplatform",
        "samesitenone",
        "http response",
        "final url",
        "status code",
        "body length",
        "kb body",
        "pragma",
        "song culture",
        "tsara lynn",
        "culture",
        "chime sa",
        "mediawarning",
        "youtube twitter",
        "jess",
        "tsara brashears",
        "zafira songs",
        "youtube og",
        "hope",
        "html info",
        "meta tags",
        "data",
        "v3 serial",
        "number",
        "cus ogoogle",
        "trust",
        "llc cngts",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "name",
        "whois lookup",
        "create date",
        "expiry date",
        "query time",
        "update date",
        "update",
        "passive dns",
        "gmt content",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "pulse pulses",
        "urls",
        "files",
        "related pulses",
        "error",
        "code",
        "algorithm",
        "first"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 343,
        "SSLCertFingerprint": 8,
        "URL": 333,
        "domain": 69,
        "hostname": 165
      },
      "indicator_count": 924,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "615 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://desertpoplar.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://desertpoplar.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776661904.2289472
}