{
  "type": "URL",
  "indicator": "https://dev.gobiz.demystdata.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://dev.gobiz.demystdata.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3989273220,
      "indicator": "https://dev.gobiz.demystdata.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "690e47a694d9bc5c12d83bc0",
          "name": "LimeRAT | Dark Room Dennis | SpyGlassPrism HealthCare",
          "description": "Invasive, dark , illegal. Malicious. Will sift through malware Spyware systems. Perpetual remote connections.  Employed by Tam Legals Christopher P. Ahmann (Colorado government) to spy on, tamper with , annoy, terrorize, out of financial awards. \n\n spyglass-w_1_.png\n\nSize\n362B (362 bytes)\nMD5\n3c0e6546a44bd9a0f2768df07db5c1c9  Copy MD5 to clipboard\nSHA1\neddf26d1da4a140f2f963b8564c4e99cd6f1a677  Copy SHA1 to clipboard\nSHA256\n83eec393865a35363695d6f2416792d0117f551bb3e41d13b141d70e6b35e02c  Copy SHA256 to clipboard",
          "modified": "2025-12-07T18:01:48.980000",
          "created": "2025-11-07T19:25:26.827000",
          "tags": [
            "germany asn",
            "as24940 hetzner",
            "status connect",
            "associated",
            "present nov",
            "germany",
            "moved",
            "present oct",
            "accept",
            "germany unknown",
            "web trebuchet",
            "ms lucida",
            "grande lucida",
            "sans unicode",
            "lucida sans",
            "tahoma",
            "passive dns",
            "title",
            "error",
            "gmbh ccp",
            "germany germany",
            "asn as197540",
            "response ip",
            "address google",
            "safe browsing",
            "present jun",
            "present may",
            "present mar",
            "present jan",
            "urls",
            "aaaa",
            "gmt content",
            "type",
            "tags",
            "tag groups",
            "countries",
            "add country",
            "malware att",
            "ck it1140",
            "information",
            "cisco",
            "umbrella rank",
            "automatic",
            "webgl",
            "please",
            "november",
            "typeof function",
            "topropertykey",
            "masonry object",
            "prism function",
            "cookies",
            "source level",
            "reverse dns",
            "protocol h2",
            "security tls",
            "asn24940",
            "online gmbh",
            "general full",
            "url https",
            "falkenstein",
            "community forum",
            "it url",
            "youtube videos",
            "twitch kanal",
            "discord channel",
            "spenden",
            "shop url",
            "google",
            "hetzneras",
            "http",
            "april",
            "de summary",
            "ehingen",
            "march",
            "google safe",
            "browsing",
            "learn",
            "issues tab",
            "value",
            "masonry",
            "domainpath name",
            "cgjerrieegagfw",
            "label",
            "input",
            "suchen nach",
            "suche",
            "form",
            "hash",
            "name value",
            "main",
            "flag",
            "contacted hosts",
            "ip address",
            "process details",
            "windir",
            "openurl c",
            "prefetch2",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "a domains",
            "ascio",
            "china unknown",
            "record value",
            "apache",
            "encrypt",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "related pulses",
            "related tags",
            "certificate",
            "hostname add",
            "url analysis",
            "files",
            "domain",
            "files ip",
            "address",
            "asn as24940",
            "less",
            "raspberry pi",
            "ubiquiti",
            "remote",
            "hostname",
            "pulse submit",
            "status",
            "entries",
            "x xss",
            "sameorigin x",
            "unicode text",
            "utf8 text",
            "click",
            "strings",
            "mitre att",
            "ck matrix",
            "pattern match",
            "ascii text",
            "href",
            "show process",
            "network traffic",
            "general",
            "hybrid",
            "local",
            "path",
            "monitored target",
            "spyglass",
            "spyware.",
            "pegasus systems",
            "prism",
            "colorado leg",
            "christopher p.ahmann",
            "ahmann",
            "christopher",
            "P",
            "tam legal",
            "treece",
            "alfrey",
            "muscat",
            "criminal",
            "jeffrey reimer",
            "theft",
            "remote connect",
            "schroeder dennis"
          ],
          "references": [
            "Domain Name: schroederdennis.de | Status: connect",
            "remote.tecbuddy.de | remote.schneider-hv.de | remotedesktop.thedipling",
            "root-dns.netcup",
            "device-*******-*****-****-****-*********.remotewd.com",
            "ai-sandboxes.com",
            "Why Is this always a problem? Just curious. - http://wyblog.us/blog/rants/strikers-get-unemployment-benefits",
            "$ is funneled back to government, (quasi) , bonused \u2018doctors\u2019 State \u2018experts\u2019  who\u2026",
            "\u2026lie about the severity of injuries and do crap like this.",
            "This money belongs to people who paid  insurance to cover on job  injuries that happen in the job.",
            "Premise liability covers premises, employees and premises visitors. Weaponizing is not covered.",
            "Those attacked are the severely injured, survivors of dead workers, victims of providers.",
            "These people aren\u2019t in the dark. They are clear of the need to pay benefits.",
            "There are absolute losers in the dole  illegally benefiting from the suffering others.",
            "https://hybrid-analysis.com/sample/00f5292bbe68d9edc68f9a22a750eafb58e4f8474e15a48e3cc217fbbd0cdef9/690e24bb39c801e6d80a824e",
            "\u2022 http://demo.ideaboxthemes.com/prism",
            "https://photoprism.thedipling.dns64.de/ \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk",
            "photoprism.thedipling.dns64.de \u2022  https://schroederdennis.de/wp-content/plugins/highlighting-code-block/assets/js/prism.js?ver=2.0.1",
            "\"OC47TWOY.txt\" has type \"ASCII text\"- [targetUID: N/A] \"spyglass-w_1_.png\" has type \"Unknown\"- [targetUID: N/A]",
            "\"spyglass-w_1_.png\" has type \"Unknown\" and extension \"png\" \"clock-g_1_.png\" has type \"Unknown\" and extension \"png\"",
            "Domain healthcareshapers.com \u2022  https://www.healthcareshapers.com/",
            "www.ventoxhealthcare.in \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk",
            "https://cullenbehavioralhealth.theraplatform.com/ \u2022 amghealthnetwork.com",
            "3ddruck-celle.de",
            "wwwwww.publicpublicwww.portal.apple-apple-number3.ipv64.net",
            "sonarr.app.pineapplegod.co.nz",
            "http://svc.ghlink.com/svc/Authenticate/Applications",
            "https://sap.dswd.gov.ph.index.ph \u2022 login.prod.siecm.gov.mg \u2022 nre-362.dev.nre.gss.gov.uk",
            "sdp-dev-ingest.ci.lineageandprovenance.gss.gov.uk",
            "http://www.xonitec.com/pornosu/yuotubesex.html",
            "rowanandbenporn.ssssssssssssshadow.home64.de",
            "https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6165363645315831&output=html&adk=1812271804&adf=3025194257&lmt=1713778114&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fschroederdennis.de%2Fubiquiti%2Fubiquiti-unifi-u6-plus-vs-u6-lite-vergleich-access-point-wifi%2F&pra=5&wgl=1&easpi=0&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyNC4wLjYzNjcuNjAiLG51bGwsMCx",
            "https://urlscan.io/result/019a5fbd-e7c6-743a-b9a7-a20e8b2943cd/",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win.Packed.Rrat-9798963-0",
              "display_name": "Win.Packed.Rrat-9798963-0",
              "target": null
            },
            {
              "id": "Win.Dropper.LimeRAT-9776087-0",
              "display_name": "Win.Dropper.LimeRAT-9776087-0",
              "target": null
            },
            {
              "id": "Malware Packed",
              "display_name": "Malware Packed",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            }
          ],
          "industries": [
            "Healthcare",
            "Legal",
            "Government",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1258,
            "hostname": 2018,
            "URL": 3033,
            "FileHash-SHA256": 651,
            "email": 4,
            "FileHash-MD5": 62,
            "FileHash-SHA1": 69,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 7100,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "176 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67035385a884405e783f9a7e",
          "name": "Mirai_Botnet_Malware | Healthcare \u00bb savethemalesdenver.com  |",
          "description": "Impacting multiple Colorado medical facilities and educational institutions and patients. || Malware Families\nBackdoor:Linux/Mirai.B\nELF:Mirai-BZ\\ [Trj]\nMirai\nMirai_Botnet_Malware\nTrojan:Win32/Zombie.A\nTrojanClicker:Win32/Frosparf\nTrojanDownloader:Win32/Fosniw\nUnix.Trojan.Mirai-6976991-0\nAd",
          "modified": "2024-11-06T01:02:24.390000",
          "created": "2024-10-07T03:20:37.224000",
          "tags": [
            "canada unknown",
            "redacted for",
            "as25825",
            "all scoreblue",
            "passive dns",
            "ipv4",
            "reverse dns",
            "next",
            "for privacy",
            "cname",
            "united states",
            "nxdomain",
            "ns nxdomain",
            "united",
            "as21928",
            "south korea",
            "as9318 sk",
            "taiwan as3462",
            "as701 verizon",
            "search",
            "maxage apt",
            "minage apt",
            "maxsize apt",
            "malware",
            "as44273 host",
            "creation date",
            "status",
            "showing",
            "record value",
            "certificate",
            "date",
            "urls",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "flag united",
            "domain",
            "files related",
            "intel",
            "ms windows",
            "users",
            "pe32",
            "number",
            "ascii text",
            "crlf line",
            "database",
            "english",
            "tue jun",
            "installer",
            "template",
            "trojan",
            "write",
            "registrar",
            "pulse submit",
            "url analysis",
            "files",
            "msie",
            "chrome",
            "rdds service",
            "record",
            "registrant",
            "admin",
            "tech contact",
            "name servers",
            "email please",
            "moved",
            "trojanproxy",
            "virtool",
            "as1221",
            "aaaa",
            "asnone united",
            "show",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "script urls",
            "gmt path",
            "fedora",
            "open ports",
            "nginx http",
            "server",
            "a domains",
            "gmt content",
            "set cookie",
            "gmt etag",
            "accept",
            "expiration date",
            "backdoor",
            "mirai",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "hostname",
            "verdict",
            "unknown",
            "new pulse",
            "loveland",
            "america asn",
            "Generic36.ABKD",
            "domains",
            "location canada",
            "as32133",
            "files ip",
            "address domain",
            "path max",
            "age86400 set",
            "cookie",
            "type",
            "entries",
            "script domains",
            "downloader",
            "body",
            "servers",
            "emails",
            "gmt max",
            "title",
            "meta",
            "as20940",
            "as16625 akamai",
            "west domains",
            "as4230 claro",
            "copy",
            "sabey",
            "contacted"
          ],
          "references": [
            "savethemalesdenver.com \u00bb https://www.uchealthcares.org | myuchealth.net | 168.200.5.63 | http://ITSupport.uchealth.org",
            "bestofus.org Location: United States of America ASN AS18693 university of colorado hospital",
            "https://floorgoddijn.nl/3798393-dad-dont-my-image-hole-fuck-ass.html",
            "https://hypnosen.fr/4306769-women-xxvideos-matured-village-african-scene-wapdam.html",
            "https://kayleighvandalen.nl/8455490-up-hot-bottoms-xxxonxxx-pics-galleries.html",
            "https://maisonduweb3.fr/6014324-porn-you-ebony-pics-black-xxx.html",
            "https://mtl-plomberie.fr/1210582-sperm-release-can-pictures-that-naija.html",
            "https://mtl-plomberie.fr/2536532-\u1200\u1260\u123b-video-xxx.html",
            "FileHash-SHA256 cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4",
            "Yara Detections: Mirai_Botnet_Malware Alerts: dead_host network_icmp nolookup_communication",
            "Domains Contacted: ntp.ubuntu.com",
            "IP\u2019s Contacted:  1.0.128.143  1.10.54.226  1.107.217.150  1.112.34.224  1.114.165.87  1.116.76.208  1.118.37.88  1.121.139.226  1.122.96.75 1.114.207.168",
            "device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com",
            "Trojan:Win32/Zombie.A FileHash-SHA256  ff43920cf098063475b4c62cd63e550fb783e3be1cf7458688b5c1d2d94c6830",
            "Yara Detections: Nrv2x ,  upx_3 ,  UPX_OEP_place ,  UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser ,",
            "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX",
            "cpe-1-159-170-17.wb05.wa.asp.telstra.net",
            "ELF:Mirai-BZ\\ [Trj] \u00bb device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com | 1.159.170.17 | Perth,  Australia ASN AS1221 telstra corporation",
            "ELF:Mirai-BZ\\ [Trj]  cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4 | Australia ASN AS1221 telstra corporation",
            "Backdoor:Linux/Mirai.B FileHash-SHA1 5df4c3322a68750c6b0c931e8ebebaa60c0a0555",
            "Yara Detections: Mirai_Botnet_Malware ,  MAL_ELF_LNX_Mirai_Oct10_2 ,  SUSP_XORed_Mozilla ,  is__elf",
            "198.49.6.6 \u00bb Loveland,  United States of America ASN AS25825 poudre valley health care inc."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan",
            "Taiwan",
            "Philippines",
            "India",
            "Italy",
            "Germany",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "ELF:Mirai-BZ\\ [Trj]",
              "display_name": "ELF:Mirai-BZ\\ [Trj]",
              "target": null
            },
            {
              "id": "Mirai_Botnet_Malware",
              "display_name": "Mirai_Botnet_Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Unix.Trojan.Mirai-6976991-0",
              "display_name": "Unix.Trojan.Mirai-6976991-0",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Backdoor:Linux/Mirai.B",
              "display_name": "Backdoor:Linux/Mirai.B",
              "target": "/malware/Backdoor:Linux/Mirai.B"
            },
            {
              "id": "TrojanDownloader:Win32/Fosniw",
              "display_name": "TrojanDownloader:Win32/Fosniw",
              "target": "/malware/TrojanDownloader:Win32/Fosniw"
            },
            {
              "id": "TrojanClicker:Win32/Frosparf",
              "display_name": "TrojanClicker:Win32/Frosparf",
              "target": "/malware/TrojanClicker:Win32/Frosparf"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Education"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 48,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1230,
            "email": 16,
            "hostname": 1560,
            "URL": 3400,
            "FileHash-SHA256": 1064,
            "FileHash-MD5": 544,
            "FileHash-SHA1": 496,
            "CVE": 1
          },
          "indicator_count": 8311,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 236,
          "modified_text": "572 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX",
        "3ddruck-celle.de",
        "https://sap.dswd.gov.ph.index.ph \u2022 login.prod.siecm.gov.mg \u2022 nre-362.dev.nre.gss.gov.uk",
        "Yara Detections: Mirai_Botnet_Malware Alerts: dead_host network_icmp nolookup_communication",
        "This money belongs to people who paid  insurance to cover on job  injuries that happen in the job.",
        "https://photoprism.thedipling.dns64.de/ \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk",
        "Backdoor:Linux/Mirai.B FileHash-SHA1 5df4c3322a68750c6b0c931e8ebebaa60c0a0555",
        "Domains Contacted: ntp.ubuntu.com",
        "https://kayleighvandalen.nl/8455490-up-hot-bottoms-xxxonxxx-pics-galleries.html",
        "http://www.xonitec.com/pornosu/yuotubesex.html",
        "https://hybrid-analysis.com/sample/00f5292bbe68d9edc68f9a22a750eafb58e4f8474e15a48e3cc217fbbd0cdef9/690e24bb39c801e6d80a824e",
        "https://floorgoddijn.nl/3798393-dad-dont-my-image-hole-fuck-ass.html",
        "https://cullenbehavioralhealth.theraplatform.com/ \u2022 amghealthnetwork.com",
        "sdp-dev-ingest.ci.lineageandprovenance.gss.gov.uk",
        "Trojan:Win32/Zombie.A FileHash-SHA256  ff43920cf098063475b4c62cd63e550fb783e3be1cf7458688b5c1d2d94c6830",
        "Yara Detections: Nrv2x ,  upx_3 ,  UPX_OEP_place ,  UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser ,",
        "cpe-1-159-170-17.wb05.wa.asp.telstra.net",
        "These people aren\u2019t in the dark. They are clear of the need to pay benefits.",
        "sonarr.app.pineapplegod.co.nz",
        "Domain Name: schroederdennis.de | Status: connect",
        "198.49.6.6 \u00bb Loveland,  United States of America ASN AS25825 poudre valley health care inc.",
        "www.ventoxhealthcare.in \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk",
        "https://mtl-plomberie.fr/2536532-\u1200\u1260\u123b-video-xxx.html",
        "root-dns.netcup",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "https://hypnosen.fr/4306769-women-xxvideos-matured-village-african-scene-wapdam.html",
        "ELF:Mirai-BZ\\ [Trj]  cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4 | Australia ASN AS1221 telstra corporation",
        "https://mtl-plomberie.fr/1210582-sperm-release-can-pictures-that-naija.html",
        "FileHash-SHA256 cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4",
        "\u2026lie about the severity of injuries and do crap like this.",
        "ELF:Mirai-BZ\\ [Trj] \u00bb device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com | 1.159.170.17 | Perth,  Australia ASN AS1221 telstra corporation",
        "Why Is this always a problem? Just curious. - http://wyblog.us/blog/rants/strikers-get-unemployment-benefits",
        "rowanandbenporn.ssssssssssssshadow.home64.de",
        "http://svc.ghlink.com/svc/Authenticate/Applications",
        "https://urlscan.io/result/019a5fbd-e7c6-743a-b9a7-a20e8b2943cd/",
        "IP\u2019s Contacted:  1.0.128.143  1.10.54.226  1.107.217.150  1.112.34.224  1.114.165.87  1.116.76.208  1.118.37.88  1.121.139.226  1.122.96.75 1.114.207.168",
        "device-*******-*****-****-****-*********.remotewd.com",
        "wwwwww.publicpublicwww.portal.apple-apple-number3.ipv64.net",
        "There are absolute losers in the dole  illegally benefiting from the suffering others.",
        "\"spyglass-w_1_.png\" has type \"Unknown\" and extension \"png\" \"clock-g_1_.png\" has type \"Unknown\" and extension \"png\"",
        "remote.tecbuddy.de | remote.schneider-hv.de | remotedesktop.thedipling",
        "\u2022 http://demo.ideaboxthemes.com/prism",
        "\"OC47TWOY.txt\" has type \"ASCII text\"- [targetUID: N/A] \"spyglass-w_1_.png\" has type \"Unknown\"- [targetUID: N/A]",
        "Domain healthcareshapers.com \u2022  https://www.healthcareshapers.com/",
        "$ is funneled back to government, (quasi) , bonused \u2018doctors\u2019 State \u2018experts\u2019  who\u2026",
        "device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com",
        "Yara Detections: Mirai_Botnet_Malware ,  MAL_ELF_LNX_Mirai_Oct10_2 ,  SUSP_XORed_Mozilla ,  is__elf",
        "photoprism.thedipling.dns64.de \u2022  https://schroederdennis.de/wp-content/plugins/highlighting-code-block/assets/js/prism.js?ver=2.0.1",
        "bestofus.org Location: United States of America ASN AS18693 university of colorado hospital",
        "ai-sandboxes.com",
        "https://maisonduweb3.fr/6014324-porn-you-ebony-pics-black-xxx.html",
        "Premise liability covers premises, employees and premises visitors. Weaponizing is not covered.",
        "savethemalesdenver.com \u00bb https://www.uchealthcares.org | myuchealth.net | 168.200.5.63 | http://ITSupport.uchealth.org",
        "https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6165363645315831&output=html&adk=1812271804&adf=3025194257&lmt=1713778114&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fschroederdennis.de%2Fubiquiti%2Fubiquiti-unifi-u6-plus-vs-u6-lite-vergleich-access-point-wifi%2F&pra=5&wgl=1&easpi=0&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyNC4wLjYzNjcuNjAiLG51bGwsMCx",
        "Those attacked are the severely injured, survivors of dead workers, victims of providers."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Mirai_botnet_malware",
            "Elf:mirai-bz\\ [trj]",
            "Win.dropper.limerat-9776087-0",
            "Win.packed.rrat-9798963-0",
            "Unix.trojan.mirai-6976991-0",
            "Malware packed",
            "Trojan:win32/zombie.a",
            "Trojanclicker:win32/frosparf",
            "Backdoor:linux/mirai.b",
            "Trojandownloader:win32/fosniw",
            "Mirai"
          ],
          "industries": [
            "Technology",
            "Legal",
            "Healthcare",
            "Government",
            "Education"
          ],
          "unique_indicators": 15857
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/demystdata.com",
    "whois": "http://whois.domaintools.com/demystdata.com",
    "domain": "demystdata.com",
    "hostname": "dev.gobiz.demystdata.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "690e47a694d9bc5c12d83bc0",
      "name": "LimeRAT | Dark Room Dennis | SpyGlassPrism HealthCare",
      "description": "Invasive, dark , illegal. Malicious. Will sift through malware Spyware systems. Perpetual remote connections.  Employed by Tam Legals Christopher P. Ahmann (Colorado government) to spy on, tamper with , annoy, terrorize, out of financial awards. \n\n spyglass-w_1_.png\n\nSize\n362B (362 bytes)\nMD5\n3c0e6546a44bd9a0f2768df07db5c1c9  Copy MD5 to clipboard\nSHA1\neddf26d1da4a140f2f963b8564c4e99cd6f1a677  Copy SHA1 to clipboard\nSHA256\n83eec393865a35363695d6f2416792d0117f551bb3e41d13b141d70e6b35e02c  Copy SHA256 to clipboard",
      "modified": "2025-12-07T18:01:48.980000",
      "created": "2025-11-07T19:25:26.827000",
      "tags": [
        "germany asn",
        "as24940 hetzner",
        "status connect",
        "associated",
        "present nov",
        "germany",
        "moved",
        "present oct",
        "accept",
        "germany unknown",
        "web trebuchet",
        "ms lucida",
        "grande lucida",
        "sans unicode",
        "lucida sans",
        "tahoma",
        "passive dns",
        "title",
        "error",
        "gmbh ccp",
        "germany germany",
        "asn as197540",
        "response ip",
        "address google",
        "safe browsing",
        "present jun",
        "present may",
        "present mar",
        "present jan",
        "urls",
        "aaaa",
        "gmt content",
        "type",
        "tags",
        "tag groups",
        "countries",
        "add country",
        "malware att",
        "ck it1140",
        "information",
        "cisco",
        "umbrella rank",
        "automatic",
        "webgl",
        "please",
        "november",
        "typeof function",
        "topropertykey",
        "masonry object",
        "prism function",
        "cookies",
        "source level",
        "reverse dns",
        "protocol h2",
        "security tls",
        "asn24940",
        "online gmbh",
        "general full",
        "url https",
        "falkenstein",
        "community forum",
        "it url",
        "youtube videos",
        "twitch kanal",
        "discord channel",
        "spenden",
        "shop url",
        "google",
        "hetzneras",
        "http",
        "april",
        "de summary",
        "ehingen",
        "march",
        "google safe",
        "browsing",
        "learn",
        "issues tab",
        "value",
        "masonry",
        "domainpath name",
        "cgjerrieegagfw",
        "label",
        "input",
        "suchen nach",
        "suche",
        "form",
        "hash",
        "name value",
        "main",
        "flag",
        "contacted hosts",
        "ip address",
        "process details",
        "windir",
        "openurl c",
        "prefetch2",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "a domains",
        "ascio",
        "china unknown",
        "record value",
        "apache",
        "encrypt",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "related pulses",
        "related tags",
        "certificate",
        "hostname add",
        "url analysis",
        "files",
        "domain",
        "files ip",
        "address",
        "asn as24940",
        "less",
        "raspberry pi",
        "ubiquiti",
        "remote",
        "hostname",
        "pulse submit",
        "status",
        "entries",
        "x xss",
        "sameorigin x",
        "unicode text",
        "utf8 text",
        "click",
        "strings",
        "mitre att",
        "ck matrix",
        "pattern match",
        "ascii text",
        "href",
        "show process",
        "network traffic",
        "general",
        "hybrid",
        "local",
        "path",
        "monitored target",
        "spyglass",
        "spyware.",
        "pegasus systems",
        "prism",
        "colorado leg",
        "christopher p.ahmann",
        "ahmann",
        "christopher",
        "P",
        "tam legal",
        "treece",
        "alfrey",
        "muscat",
        "criminal",
        "jeffrey reimer",
        "theft",
        "remote connect",
        "schroeder dennis"
      ],
      "references": [
        "Domain Name: schroederdennis.de | Status: connect",
        "remote.tecbuddy.de | remote.schneider-hv.de | remotedesktop.thedipling",
        "root-dns.netcup",
        "device-*******-*****-****-****-*********.remotewd.com",
        "ai-sandboxes.com",
        "Why Is this always a problem? Just curious. - http://wyblog.us/blog/rants/strikers-get-unemployment-benefits",
        "$ is funneled back to government, (quasi) , bonused \u2018doctors\u2019 State \u2018experts\u2019  who\u2026",
        "\u2026lie about the severity of injuries and do crap like this.",
        "This money belongs to people who paid  insurance to cover on job  injuries that happen in the job.",
        "Premise liability covers premises, employees and premises visitors. Weaponizing is not covered.",
        "Those attacked are the severely injured, survivors of dead workers, victims of providers.",
        "These people aren\u2019t in the dark. They are clear of the need to pay benefits.",
        "There are absolute losers in the dole  illegally benefiting from the suffering others.",
        "https://hybrid-analysis.com/sample/00f5292bbe68d9edc68f9a22a750eafb58e4f8474e15a48e3cc217fbbd0cdef9/690e24bb39c801e6d80a824e",
        "\u2022 http://demo.ideaboxthemes.com/prism",
        "https://photoprism.thedipling.dns64.de/ \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk",
        "photoprism.thedipling.dns64.de \u2022  https://schroederdennis.de/wp-content/plugins/highlighting-code-block/assets/js/prism.js?ver=2.0.1",
        "\"OC47TWOY.txt\" has type \"ASCII text\"- [targetUID: N/A] \"spyglass-w_1_.png\" has type \"Unknown\"- [targetUID: N/A]",
        "\"spyglass-w_1_.png\" has type \"Unknown\" and extension \"png\" \"clock-g_1_.png\" has type \"Unknown\" and extension \"png\"",
        "Domain healthcareshapers.com \u2022  https://www.healthcareshapers.com/",
        "www.ventoxhealthcare.in \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk",
        "https://cullenbehavioralhealth.theraplatform.com/ \u2022 amghealthnetwork.com",
        "3ddruck-celle.de",
        "wwwwww.publicpublicwww.portal.apple-apple-number3.ipv64.net",
        "sonarr.app.pineapplegod.co.nz",
        "http://svc.ghlink.com/svc/Authenticate/Applications",
        "https://sap.dswd.gov.ph.index.ph \u2022 login.prod.siecm.gov.mg \u2022 nre-362.dev.nre.gss.gov.uk",
        "sdp-dev-ingest.ci.lineageandprovenance.gss.gov.uk",
        "http://www.xonitec.com/pornosu/yuotubesex.html",
        "rowanandbenporn.ssssssssssssshadow.home64.de",
        "https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6165363645315831&output=html&adk=1812271804&adf=3025194257&lmt=1713778114&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fschroederdennis.de%2Fubiquiti%2Fubiquiti-unifi-u6-plus-vs-u6-lite-vergleich-access-point-wifi%2F&pra=5&wgl=1&easpi=0&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyNC4wLjYzNjcuNjAiLG51bGwsMCx",
        "https://urlscan.io/result/019a5fbd-e7c6-743a-b9a7-a20e8b2943cd/",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win.Packed.Rrat-9798963-0",
          "display_name": "Win.Packed.Rrat-9798963-0",
          "target": null
        },
        {
          "id": "Win.Dropper.LimeRAT-9776087-0",
          "display_name": "Win.Dropper.LimeRAT-9776087-0",
          "target": null
        },
        {
          "id": "Malware Packed",
          "display_name": "Malware Packed",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        }
      ],
      "industries": [
        "Healthcare",
        "Legal",
        "Government",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1258,
        "hostname": 2018,
        "URL": 3033,
        "FileHash-SHA256": 651,
        "email": 4,
        "FileHash-MD5": 62,
        "FileHash-SHA1": 69,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 7100,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "176 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67035385a884405e783f9a7e",
      "name": "Mirai_Botnet_Malware | Healthcare \u00bb savethemalesdenver.com  |",
      "description": "Impacting multiple Colorado medical facilities and educational institutions and patients. || Malware Families\nBackdoor:Linux/Mirai.B\nELF:Mirai-BZ\\ [Trj]\nMirai\nMirai_Botnet_Malware\nTrojan:Win32/Zombie.A\nTrojanClicker:Win32/Frosparf\nTrojanDownloader:Win32/Fosniw\nUnix.Trojan.Mirai-6976991-0\nAd",
      "modified": "2024-11-06T01:02:24.390000",
      "created": "2024-10-07T03:20:37.224000",
      "tags": [
        "canada unknown",
        "redacted for",
        "as25825",
        "all scoreblue",
        "passive dns",
        "ipv4",
        "reverse dns",
        "next",
        "for privacy",
        "cname",
        "united states",
        "nxdomain",
        "ns nxdomain",
        "united",
        "as21928",
        "south korea",
        "as9318 sk",
        "taiwan as3462",
        "as701 verizon",
        "search",
        "maxage apt",
        "minage apt",
        "maxsize apt",
        "malware",
        "as44273 host",
        "creation date",
        "status",
        "showing",
        "record value",
        "certificate",
        "date",
        "urls",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "flag united",
        "domain",
        "files related",
        "intel",
        "ms windows",
        "users",
        "pe32",
        "number",
        "ascii text",
        "crlf line",
        "database",
        "english",
        "tue jun",
        "installer",
        "template",
        "trojan",
        "write",
        "registrar",
        "pulse submit",
        "url analysis",
        "files",
        "msie",
        "chrome",
        "rdds service",
        "record",
        "registrant",
        "admin",
        "tech contact",
        "name servers",
        "email please",
        "moved",
        "trojanproxy",
        "virtool",
        "as1221",
        "aaaa",
        "asnone united",
        "show",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "script urls",
        "gmt path",
        "fedora",
        "open ports",
        "nginx http",
        "server",
        "a domains",
        "gmt content",
        "set cookie",
        "gmt etag",
        "accept",
        "expiration date",
        "backdoor",
        "mirai",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "hostname",
        "verdict",
        "unknown",
        "new pulse",
        "loveland",
        "america asn",
        "Generic36.ABKD",
        "domains",
        "location canada",
        "as32133",
        "files ip",
        "address domain",
        "path max",
        "age86400 set",
        "cookie",
        "type",
        "entries",
        "script domains",
        "downloader",
        "body",
        "servers",
        "emails",
        "gmt max",
        "title",
        "meta",
        "as20940",
        "as16625 akamai",
        "west domains",
        "as4230 claro",
        "copy",
        "sabey",
        "contacted"
      ],
      "references": [
        "savethemalesdenver.com \u00bb https://www.uchealthcares.org | myuchealth.net | 168.200.5.63 | http://ITSupport.uchealth.org",
        "bestofus.org Location: United States of America ASN AS18693 university of colorado hospital",
        "https://floorgoddijn.nl/3798393-dad-dont-my-image-hole-fuck-ass.html",
        "https://hypnosen.fr/4306769-women-xxvideos-matured-village-african-scene-wapdam.html",
        "https://kayleighvandalen.nl/8455490-up-hot-bottoms-xxxonxxx-pics-galleries.html",
        "https://maisonduweb3.fr/6014324-porn-you-ebony-pics-black-xxx.html",
        "https://mtl-plomberie.fr/1210582-sperm-release-can-pictures-that-naija.html",
        "https://mtl-plomberie.fr/2536532-\u1200\u1260\u123b-video-xxx.html",
        "FileHash-SHA256 cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4",
        "Yara Detections: Mirai_Botnet_Malware Alerts: dead_host network_icmp nolookup_communication",
        "Domains Contacted: ntp.ubuntu.com",
        "IP\u2019s Contacted:  1.0.128.143  1.10.54.226  1.107.217.150  1.112.34.224  1.114.165.87  1.116.76.208  1.118.37.88  1.121.139.226  1.122.96.75 1.114.207.168",
        "device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com",
        "Trojan:Win32/Zombie.A FileHash-SHA256  ff43920cf098063475b4c62cd63e550fb783e3be1cf7458688b5c1d2d94c6830",
        "Yara Detections: Nrv2x ,  upx_3 ,  UPX_OEP_place ,  UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser ,",
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX",
        "cpe-1-159-170-17.wb05.wa.asp.telstra.net",
        "ELF:Mirai-BZ\\ [Trj] \u00bb device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com | 1.159.170.17 | Perth,  Australia ASN AS1221 telstra corporation",
        "ELF:Mirai-BZ\\ [Trj]  cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4 | Australia ASN AS1221 telstra corporation",
        "Backdoor:Linux/Mirai.B FileHash-SHA1 5df4c3322a68750c6b0c931e8ebebaa60c0a0555",
        "Yara Detections: Mirai_Botnet_Malware ,  MAL_ELF_LNX_Mirai_Oct10_2 ,  SUSP_XORed_Mozilla ,  is__elf",
        "198.49.6.6 \u00bb Loveland,  United States of America ASN AS25825 poudre valley health care inc."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan",
        "Taiwan",
        "Philippines",
        "India",
        "Italy",
        "Germany",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "ELF:Mirai-BZ\\ [Trj]",
          "display_name": "ELF:Mirai-BZ\\ [Trj]",
          "target": null
        },
        {
          "id": "Mirai_Botnet_Malware",
          "display_name": "Mirai_Botnet_Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Unix.Trojan.Mirai-6976991-0",
          "display_name": "Unix.Trojan.Mirai-6976991-0",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Backdoor:Linux/Mirai.B",
          "display_name": "Backdoor:Linux/Mirai.B",
          "target": "/malware/Backdoor:Linux/Mirai.B"
        },
        {
          "id": "TrojanDownloader:Win32/Fosniw",
          "display_name": "TrojanDownloader:Win32/Fosniw",
          "target": "/malware/TrojanDownloader:Win32/Fosniw"
        },
        {
          "id": "TrojanClicker:Win32/Frosparf",
          "display_name": "TrojanClicker:Win32/Frosparf",
          "target": "/malware/TrojanClicker:Win32/Frosparf"
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Education"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 48,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1230,
        "email": 16,
        "hostname": 1560,
        "URL": 3400,
        "FileHash-SHA256": 1064,
        "FileHash-MD5": 544,
        "FileHash-SHA1": 496,
        "CVE": 1
      },
      "indicator_count": 8311,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 236,
      "modified_text": "572 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://dev.gobiz.demystdata.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://dev.gobiz.demystdata.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780344322.1395226
}