{
  "type": "URL",
  "indicator": "https://dev-prod.horserepublic.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://dev-prod.horserepublic.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4124440855,
      "indicator": "https://dev-prod.horserepublic.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68bc597c34358af14891a484",
          "name": "A State: Government Financial Department affected by malware and threat actors",
          "description": "A State Governmental Financial Department contacted. Lightly researched link below.\nFinal URL: https://www.palantir.com/blocked/?blocker=Envoy&ip=35.243.23.172&vpcEndpoint=&errorInstanceId=b8ae0a73-8c2d-4d81-a6ea-ee53943e9485&targetDomain=millet-usgc-1.palantirfedstart. |  403 Code - contacted |",
          "modified": "2025-10-06T15:03:41.536000",
          "created": "2025-09-06T15:55:40.069000",
          "tags": [
            "status",
            "united",
            "unknown ns",
            "search",
            "certificate",
            "passive dns",
            "urls",
            "record value",
            "emails",
            "date",
            "title",
            "present jul",
            "script urls",
            "security",
            "a domains",
            "script domains",
            "read",
            "meta",
            "443 ma86400",
            "next associated",
            "files show",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "gmt server",
            "extraction f",
            "enter so",
            "type",
            "u extraction",
            "data upload",
            "extraction",
            "orbrop",
            "present aug",
            "present jun",
            "present oct",
            "entries",
            "present apr",
            "present nov",
            "gtmpsl84dj",
            "resolved ips",
            "c0002 wininet",
            "data",
            "datacrashpad",
            "edge",
            "url data",
            "accept",
            "gmt ifnonematch",
            "address port",
            "cname",
            "response",
            "nxdomain",
            "name n",
            "creation date",
            "domain add",
            "pulse pulses",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "whois registrar"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1785,
            "domain": 710,
            "hostname": 949,
            "FileHash-SHA256": 864,
            "email": 4,
            "CVE": 3,
            "FileHash-MD5": 27,
            "FileHash-SHA1": 27
          },
          "indicator_count": 4369,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "195 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68bbdb22e3d606ae8fb5cda8",
          "name": "HCPF | Department of Health Care Policy and Financing",
          "description": "Project Nemesis - Affects Department of Health Care Policy and Financing | Family representative  repeatedly told past bills aren\u2019t being paid by United Healthcare. Argus Insurance (unknown entity) was Policy on record target never had. FR was given information regarding HCPF which was being viewed by past vendor seen in (https://otx.alienvault.com/pulse/68bbb31f6d91989d7fcd9592) |  Issues with HCPF have been an issue for some time in isolated scenarios. It\u2019s unclear how at least one person keeps getting their name, bills and life pulled into this. Target PURCHASED a Healthcare policy via agent before major social engineering attacks. Same entity literally robs targets. Gift cards, phone services, cloud storage, account, insurance policies, bank account access, tax refunds, paid claims reversed & taken from target\u2019s account.\nMore research needed. Flaws  in new system could jeopardize many. \n#trulymissed #rip #techbrohell #palantir",
          "modified": "2025-10-06T05:01:18.794000",
          "created": "2025-09-06T06:56:34.649000",
          "tags": [
            "federal changes",
            "health first",
            "colorado",
            "child health",
            "plan plus",
            "newimpact",
            "medicaidour",
            "impact",
            "medicaid page",
            "medicaid",
            "beware",
            "text/html",
            "trackers",
            "iframes",
            "external-resources",
            "new relic",
            "g1gv3h3sxc0",
            "utc gcw970gh4gg",
            "android",
            "known exploited",
            "google",
            "salesloft drift",
            "sap s4hana",
            "cve202542957",
            "cisa",
            "sitecore",
            "linux",
            "france",
            "meta",
            "rokrat",
            "lizar",
            "project nemesis",
            "carbanak",
            "cobalt strike",
            "domino",
            "no expiration",
            "url https",
            "type indicator",
            "role title",
            "related pulses",
            "hostname https",
            "m4e5930",
            "hostname",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "ascii text",
            "search",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "dock",
            "write",
            "capture",
            "persistence",
            "malware",
            "roboto",
            "present feb",
            "united",
            "a domains",
            "present dec",
            "passive dns",
            "moved",
            "script domains",
            "script urls",
            "urls",
            "title",
            "date",
            "resolved ips",
            "http traffic",
            "http get",
            "match info",
            "downloads",
            "info",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "protocol t1095",
            "endgame systems"
          ],
          "references": [
            "Researched: https://hcpf.colorado.gov/",
            "www.onyx-ware.com \u2022 https://www.endgamesystems.com/",
            "millet-usgc-1.palantirfedstart.com",
            "https://securityaffairs.com/109671/hacking/50000-home-cameras-hacked.html",
            "https://passwords.google/?utm_medium=hpp&utm_source=google&utm_campaign=sid2023aunonenms",
            "https://passwords.google/?utm_medium=hpp&utm",
            "https://securityaffairs.com/181338/security/google-fixed-chrome-flaw-found-by-big-sleep-ai.html",
            "Researched publicly available information provided by representative of a target\u2019s estate",
            "System has placed affected on multiple policies cancelling private policy without notice.",
            "Paid for plan long after entity put target on a state plan. Target audited for making too much money (framed)",
            "Provided documented evidence of appealed state issued plan and disclosed financials.",
            "Won appeal. Denied stimulus until passing another audit showing taxable income and filed taxes",
            "I hope this goes smoothly. I believe will be a nightmare as witnessed. I hope I\u2019m wrong.",
            "State (or random \u2022_- hackers) erased evidence of targets insurance all paid for by target.",
            "Target also owned an online brokerage & lead company, was agent & insurance marketer for years.",
            "September began with false information, defaulted claims , denials from authorized  services rendered years prior.",
            "If someone has Medicare it\u2019s wise to check with carrier & providers to see policies generated by AI"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lizar",
              "display_name": "Lizar",
              "target": null
            },
            {
              "id": "Project Nemesis",
              "display_name": "Project Nemesis",
              "target": null
            },
            {
              "id": "Carbanak",
              "display_name": "Carbanak",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Domino",
              "display_name": "Domino",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [
            "Hospitality",
            "Financial",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1395,
            "URL": 4304,
            "CVE": 1,
            "domain": 694,
            "FileHash-SHA256": 1790,
            "FileHash-MD5": 183,
            "FileHash-SHA1": 103,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 8475,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "195 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ae5b9ef87646927a236b61",
          "name": "Privacy - Google Videos Search - Web Applications Stack Exchange = WannaCry",
          "description": "Description: dfir.blog - A blog about Digital Forensics & Incident Response\ndfir.blog\nDigital forensics, web browsers, visualizations, & open source tools.\n#monitoring #dod(?) #chinacache #crypt #ransom#infectedsystems",
          "modified": "2025-09-26T00:01:12.214000",
          "created": "2025-08-27T01:13:02.780000",
          "tags": [
            "google",
            "mullvad browser",
            "value",
            "incognito mode",
            "mine",
            "unix time",
            "friday",
            "january",
            "does",
            "tor browser",
            "search",
            "show",
            "langchinese",
            "packing t1045",
            "t1045",
            "medium",
            "pe resource",
            "module load",
            "t1129",
            "service",
            "trojan",
            "copy",
            "dock",
            "write",
            "malware",
            "clock",
            "united",
            "passive dns",
            "urls",
            "next associated",
            "gmt cache",
            "ipv4 add",
            "pulse pulses",
            "files",
            "reverse dns",
            "win32",
            "title",
            "location united",
            "america flag",
            "america asn",
            "as15169 google",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "present aug",
            "china unknown",
            "creation date",
            "date",
            "domain",
            "ip address",
            "domain name",
            "expiration date",
            "status ok",
            "nanjing",
            "accept",
            "body",
            "div td",
            "td tr",
            "div div",
            "span span",
            "a li",
            "span p",
            "p div",
            "moved",
            "a domains",
            "open",
            "span",
            "uuupupu",
            "t1055",
            "process32nextw",
            "high",
            "windows",
            "high defense",
            "evasion",
            "delphi",
            "google gmail",
            "images sign",
            "advanced search",
            "solutions",
            "privacy",
            "store gmail",
            "delete delete",
            "report",
            "how search",
            "applying ai",
            "settings search",
            "advanced",
            "search search",
            "search help",
            "domainabuse",
            "showing",
            "hostname add",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "read c",
            "tlsv1",
            "whitelisted",
            "port",
            "destination",
            "ascii text",
            "next",
            "encrypt",
            "script urls",
            "msie",
            "chrome",
            "bad gateway",
            "script domains",
            "present feb",
            "link",
            "meta",
            "digital",
            "language",
            "body doctype",
            "ghost",
            "present jun",
            "aaaa",
            "present jul",
            "present oct",
            "record value",
            "yara detections",
            "dock zone",
            "top source",
            "top destination",
            "source source",
            "filehash",
            "code",
            "error",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "execution",
            "persistence",
            "tulach",
            "brian sabey",
            "dod network",
            "orgtechref",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity dnic",
            "handle",
            "whois lookup",
            "dod",
            "et trojan",
            "server header",
            "suspicious",
            "et info",
            "unknown",
            "virustotal",
            "specified",
            "download",
            "et",
            "please",
            "type size",
            "first seen",
            "loading",
            "python wheel",
            "dynamicloader",
            "intel",
            "ms windows",
            "pe32",
            "entries",
            "user agent",
            "powershell",
            "agent",
            "yara rule",
            "checks",
            "levelblue",
            "open threat",
            "observed dns",
            "query",
            "dns lookup",
            "msdos",
            "wannacry dns",
            "lookup",
            "wannacry",
            "worm",
            "explorer",
            "msil",
            "darkcomet",
            "ping",
            "tools",
            "capture",
            "hallrender",
            "dga domains",
            "unfurl sites",
            "honey net",
            "bot",
            "nxdomain",
            "potential-c2"
          ],
          "references": [
            "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
            "DoD Network Information Center (DNIC)",
            "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
            "Python Wheel package",
            "https://www.google.com/search",
            "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
            "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Magania.DSK!MTB",
              "display_name": "Trojan:Win32/Magania.DSK!MTB",
              "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "a variant of Win32/Kryptik.DEOA",
              "display_name": "a variant of Win32/Kryptik.DEOA",
              "target": null
            },
            {
              "id": "ALF:Exploit:Win32/gSharedInfoRef.A",
              "display_name": "ALF:Exploit:Win32/gSharedInfoRef.A",
              "target": null
            },
            {
              "id": "Wannacry",
              "display_name": "Wannacry",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1054",
              "name": "Indicator Blocking",
              "display_name": "T1054 - Indicator Blocking"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Civilian"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8221,
            "domain": 1216,
            "FileHash-SHA256": 2434,
            "FileHash-MD5": 296,
            "FileHash-SHA1": 155,
            "hostname": 2939,
            "email": 7,
            "SSLCertFingerprint": 8,
            "CIDR": 2
          },
          "indicator_count": 15278,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "205 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "If someone has Medicare it\u2019s wise to check with carrier & providers to see policies generated by AI",
        "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
        "Won appeal. Denied stimulus until passing another audit showing taxable income and filed taxes",
        "https://securityaffairs.com/109671/hacking/50000-home-cameras-hacked.html",
        "I hope this goes smoothly. I believe will be a nightmare as witnessed. I hope I\u2019m wrong.",
        "https://www.google.com/search",
        "Paid for plan long after entity put target on a state plan. Target audited for making too much money (framed)",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
        "https://passwords.google/?utm_medium=hpp&utm",
        "September began with false information, defaulted claims , denials from authorized  services rendered years prior.",
        "https://securityaffairs.com/181338/security/google-fixed-chrome-flaw-found-by-big-sleep-ai.html",
        "System has placed affected on multiple policies cancelling private policy without notice.",
        "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
        "Researched publicly available information provided by representative of a target\u2019s estate",
        "Target also owned an online brokerage & lead company, was agent & insurance marketer for years.",
        "Provided documented evidence of appealed state issued plan and disclosed financials.",
        "State (or random \u2022_- hackers) erased evidence of targets insurance all paid for by target.",
        "www.onyx-ware.com \u2022 https://www.endgamesystems.com/",
        "millet-usgc-1.palantirfedstart.com",
        "Python Wheel package",
        "https://passwords.google/?utm_medium=hpp&utm_source=google&utm_campaign=sid2023aunonenms",
        "Researched: https://hcpf.colorado.gov/",
        "DoD Network Information Center (DNIC)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Cobalt strike",
            "Lizar",
            "Trojan:win32/magania.dsk!mtb",
            "Wannacry",
            "Trojan:win32/zusy",
            "Et",
            "Carbanak",
            "Alf:exploit:win32/gsharedinforef.a",
            "A variant of win32/kryptik.deoa",
            "Domino",
            "Project nemesis"
          ],
          "industries": [
            "Technology",
            "Healthcare",
            "Financial",
            "Hospitality",
            "Civilian",
            "Telecommunications"
          ],
          "unique_indicators": 26717
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/horserepublic.com",
    "whois": "http://whois.domaintools.com/horserepublic.com",
    "domain": "horserepublic.com",
    "hostname": "dev-prod.horserepublic.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68bc597c34358af14891a484",
      "name": "A State: Government Financial Department affected by malware and threat actors",
      "description": "A State Governmental Financial Department contacted. Lightly researched link below.\nFinal URL: https://www.palantir.com/blocked/?blocker=Envoy&ip=35.243.23.172&vpcEndpoint=&errorInstanceId=b8ae0a73-8c2d-4d81-a6ea-ee53943e9485&targetDomain=millet-usgc-1.palantirfedstart. |  403 Code - contacted |",
      "modified": "2025-10-06T15:03:41.536000",
      "created": "2025-09-06T15:55:40.069000",
      "tags": [
        "status",
        "united",
        "unknown ns",
        "search",
        "certificate",
        "passive dns",
        "urls",
        "record value",
        "emails",
        "date",
        "title",
        "present jul",
        "script urls",
        "security",
        "a domains",
        "script domains",
        "read",
        "meta",
        "443 ma86400",
        "next associated",
        "files show",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "gmt server",
        "extraction f",
        "enter so",
        "type",
        "u extraction",
        "data upload",
        "extraction",
        "orbrop",
        "present aug",
        "present jun",
        "present oct",
        "entries",
        "present apr",
        "present nov",
        "gtmpsl84dj",
        "resolved ips",
        "c0002 wininet",
        "data",
        "datacrashpad",
        "edge",
        "url data",
        "accept",
        "gmt ifnonematch",
        "address port",
        "cname",
        "response",
        "nxdomain",
        "name n",
        "creation date",
        "domain add",
        "pulse pulses",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "whois registrar"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1785,
        "domain": 710,
        "hostname": 949,
        "FileHash-SHA256": 864,
        "email": 4,
        "CVE": 3,
        "FileHash-MD5": 27,
        "FileHash-SHA1": 27
      },
      "indicator_count": 4369,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "195 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68bbdb22e3d606ae8fb5cda8",
      "name": "HCPF | Department of Health Care Policy and Financing",
      "description": "Project Nemesis - Affects Department of Health Care Policy and Financing | Family representative  repeatedly told past bills aren\u2019t being paid by United Healthcare. Argus Insurance (unknown entity) was Policy on record target never had. FR was given information regarding HCPF which was being viewed by past vendor seen in (https://otx.alienvault.com/pulse/68bbb31f6d91989d7fcd9592) |  Issues with HCPF have been an issue for some time in isolated scenarios. It\u2019s unclear how at least one person keeps getting their name, bills and life pulled into this. Target PURCHASED a Healthcare policy via agent before major social engineering attacks. Same entity literally robs targets. Gift cards, phone services, cloud storage, account, insurance policies, bank account access, tax refunds, paid claims reversed & taken from target\u2019s account.\nMore research needed. Flaws  in new system could jeopardize many. \n#trulymissed #rip #techbrohell #palantir",
      "modified": "2025-10-06T05:01:18.794000",
      "created": "2025-09-06T06:56:34.649000",
      "tags": [
        "federal changes",
        "health first",
        "colorado",
        "child health",
        "plan plus",
        "newimpact",
        "medicaidour",
        "impact",
        "medicaid page",
        "medicaid",
        "beware",
        "text/html",
        "trackers",
        "iframes",
        "external-resources",
        "new relic",
        "g1gv3h3sxc0",
        "utc gcw970gh4gg",
        "android",
        "known exploited",
        "google",
        "salesloft drift",
        "sap s4hana",
        "cve202542957",
        "cisa",
        "sitecore",
        "linux",
        "france",
        "meta",
        "rokrat",
        "lizar",
        "project nemesis",
        "carbanak",
        "cobalt strike",
        "domino",
        "no expiration",
        "url https",
        "type indicator",
        "role title",
        "related pulses",
        "hostname https",
        "m4e5930",
        "hostname",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "ascii text",
        "search",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "dock",
        "write",
        "capture",
        "persistence",
        "malware",
        "roboto",
        "present feb",
        "united",
        "a domains",
        "present dec",
        "passive dns",
        "moved",
        "script domains",
        "script urls",
        "urls",
        "title",
        "date",
        "resolved ips",
        "http traffic",
        "http get",
        "match info",
        "downloads",
        "info",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "protocol t1095",
        "endgame systems"
      ],
      "references": [
        "Researched: https://hcpf.colorado.gov/",
        "www.onyx-ware.com \u2022 https://www.endgamesystems.com/",
        "millet-usgc-1.palantirfedstart.com",
        "https://securityaffairs.com/109671/hacking/50000-home-cameras-hacked.html",
        "https://passwords.google/?utm_medium=hpp&utm_source=google&utm_campaign=sid2023aunonenms",
        "https://passwords.google/?utm_medium=hpp&utm",
        "https://securityaffairs.com/181338/security/google-fixed-chrome-flaw-found-by-big-sleep-ai.html",
        "Researched publicly available information provided by representative of a target\u2019s estate",
        "System has placed affected on multiple policies cancelling private policy without notice.",
        "Paid for plan long after entity put target on a state plan. Target audited for making too much money (framed)",
        "Provided documented evidence of appealed state issued plan and disclosed financials.",
        "Won appeal. Denied stimulus until passing another audit showing taxable income and filed taxes",
        "I hope this goes smoothly. I believe will be a nightmare as witnessed. I hope I\u2019m wrong.",
        "State (or random \u2022_- hackers) erased evidence of targets insurance all paid for by target.",
        "Target also owned an online brokerage & lead company, was agent & insurance marketer for years.",
        "September began with false information, defaulted claims , denials from authorized  services rendered years prior.",
        "If someone has Medicare it\u2019s wise to check with carrier & providers to see policies generated by AI"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lizar",
          "display_name": "Lizar",
          "target": null
        },
        {
          "id": "Project Nemesis",
          "display_name": "Project Nemesis",
          "target": null
        },
        {
          "id": "Carbanak",
          "display_name": "Carbanak",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Domino",
          "display_name": "Domino",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [
        "Hospitality",
        "Financial",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1395,
        "URL": 4304,
        "CVE": 1,
        "domain": 694,
        "FileHash-SHA256": 1790,
        "FileHash-MD5": 183,
        "FileHash-SHA1": 103,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 8475,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "195 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ae5b9ef87646927a236b61",
      "name": "Privacy - Google Videos Search - Web Applications Stack Exchange = WannaCry",
      "description": "Description: dfir.blog - A blog about Digital Forensics & Incident Response\ndfir.blog\nDigital forensics, web browsers, visualizations, & open source tools.\n#monitoring #dod(?) #chinacache #crypt #ransom#infectedsystems",
      "modified": "2025-09-26T00:01:12.214000",
      "created": "2025-08-27T01:13:02.780000",
      "tags": [
        "google",
        "mullvad browser",
        "value",
        "incognito mode",
        "mine",
        "unix time",
        "friday",
        "january",
        "does",
        "tor browser",
        "search",
        "show",
        "langchinese",
        "packing t1045",
        "t1045",
        "medium",
        "pe resource",
        "module load",
        "t1129",
        "service",
        "trojan",
        "copy",
        "dock",
        "write",
        "malware",
        "clock",
        "united",
        "passive dns",
        "urls",
        "next associated",
        "gmt cache",
        "ipv4 add",
        "pulse pulses",
        "files",
        "reverse dns",
        "win32",
        "title",
        "location united",
        "america flag",
        "america asn",
        "as15169 google",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "present aug",
        "china unknown",
        "creation date",
        "date",
        "domain",
        "ip address",
        "domain name",
        "expiration date",
        "status ok",
        "nanjing",
        "accept",
        "body",
        "div td",
        "td tr",
        "div div",
        "span span",
        "a li",
        "span p",
        "p div",
        "moved",
        "a domains",
        "open",
        "span",
        "uuupupu",
        "t1055",
        "process32nextw",
        "high",
        "windows",
        "high defense",
        "evasion",
        "delphi",
        "google gmail",
        "images sign",
        "advanced search",
        "solutions",
        "privacy",
        "store gmail",
        "delete delete",
        "report",
        "how search",
        "applying ai",
        "settings search",
        "advanced",
        "search search",
        "search help",
        "domainabuse",
        "showing",
        "hostname add",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "read c",
        "tlsv1",
        "whitelisted",
        "port",
        "destination",
        "ascii text",
        "next",
        "encrypt",
        "script urls",
        "msie",
        "chrome",
        "bad gateway",
        "script domains",
        "present feb",
        "link",
        "meta",
        "digital",
        "language",
        "body doctype",
        "ghost",
        "present jun",
        "aaaa",
        "present jul",
        "present oct",
        "record value",
        "yara detections",
        "dock zone",
        "top source",
        "top destination",
        "source source",
        "filehash",
        "code",
        "error",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "execution",
        "persistence",
        "tulach",
        "brian sabey",
        "dod network",
        "orgtechref",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity dnic",
        "handle",
        "whois lookup",
        "dod",
        "et trojan",
        "server header",
        "suspicious",
        "et info",
        "unknown",
        "virustotal",
        "specified",
        "download",
        "et",
        "please",
        "type size",
        "first seen",
        "loading",
        "python wheel",
        "dynamicloader",
        "intel",
        "ms windows",
        "pe32",
        "entries",
        "user agent",
        "powershell",
        "agent",
        "yara rule",
        "checks",
        "levelblue",
        "open threat",
        "observed dns",
        "query",
        "dns lookup",
        "msdos",
        "wannacry dns",
        "lookup",
        "wannacry",
        "worm",
        "explorer",
        "msil",
        "darkcomet",
        "ping",
        "tools",
        "capture",
        "hallrender",
        "dga domains",
        "unfurl sites",
        "honey net",
        "bot",
        "nxdomain",
        "potential-c2"
      ],
      "references": [
        "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
        "DoD Network Information Center (DNIC)",
        "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
        "Python Wheel package",
        "https://www.google.com/search",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Magania.DSK!MTB",
          "display_name": "Trojan:Win32/Magania.DSK!MTB",
          "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "a variant of Win32/Kryptik.DEOA",
          "display_name": "a variant of Win32/Kryptik.DEOA",
          "target": null
        },
        {
          "id": "ALF:Exploit:Win32/gSharedInfoRef.A",
          "display_name": "ALF:Exploit:Win32/gSharedInfoRef.A",
          "target": null
        },
        {
          "id": "Wannacry",
          "display_name": "Wannacry",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1054",
          "name": "Indicator Blocking",
          "display_name": "T1054 - Indicator Blocking"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology",
        "Civilian"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8221,
        "domain": 1216,
        "FileHash-SHA256": 2434,
        "FileHash-MD5": 296,
        "FileHash-SHA1": 155,
        "hostname": 2939,
        "email": 7,
        "SSLCertFingerprint": 8,
        "CIDR": 2
      },
      "indicator_count": 15278,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "205 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://dev-prod.horserepublic.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://dev-prod.horserepublic.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776631176.9263763
}