{
  "type": "URL",
  "indicator": "https://devblog.jorsin.se/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://devblog.jorsin.se/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4121231637,
      "indicator": "https://devblog.jorsin.se/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69decb6dd1bd6da78fc72d0a",
          "name": "Solarwinds Similarties? Tactics ASP.Net IoC\u2019s ISOLATED",
          "description": "Does this have similarities to the SolarWinds Attack? Anyone?\n\nASP.NET is a web application framework created by Microsoft for building dynamic web applications.\nIt enables developers to create web pages that can interact with databases and respond to user inputs.\nASP.NET supports various programming languages, including C# and VB.NET.\nContext: ASP.NET is widely used for developing modern web applications and services. It allows developers to create interactive and data-driven web pages that can run on various operating systems, including Windows, Linux, and macOS. The framework is open-source and supports various architectures, including MVC (Model-View-Controller) and Web API, which facilitate the organization and development of complex applications.\nIn many instances ASP.net has been seen connected to malicious Tulach , Apple , a browser agent that transmits data to New Relic's collectors by using either of the domains bam.nr-data.net or bam-cell.nr-data.net.",
          "modified": "2026-04-14T23:19:09.495000",
          "created": "2026-04-14T23:19:09.495000",
          "tags": [
            "united",
            "aaaa",
            "certificate",
            "error",
            "read c",
            "rgba",
            "unicode",
            "memcommit",
            "delete",
            "dock",
            "execution",
            "command decode",
            "suricata ipv4",
            "suricata tcpv4",
            "flag",
            "localappdata",
            "windir",
            "openurl c",
            "programfiles",
            "suricata udpv4",
            "win64",
            "click",
            "strings",
            "anon",
            "username",
            "userprofile",
            "mitre att",
            "ck id",
            "ck matrix",
            "appdata",
            "comspec",
            "model",
            "path",
            "april",
            "hybrid",
            "general",
            "learn",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ck techniques",
            "mtb apr",
            "exploit",
            "trojan",
            "backdoor",
            "please",
            "x msedge",
            "all ipv4",
            "ransom",
            "date hash",
            "avast avg",
            "win32orbus apr",
            "dynamicloader",
            "yara rule",
            "high",
            "tofsee",
            "rndhex",
            "rndchar",
            "loaderid",
            "lidfileupd",
            "localcfg",
            "write",
            "stream",
            "push",
            "mtb alerts",
            "ee fc",
            "ff d5",
            "lredmond",
            "malware",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "yara detections",
            "av detections",
            "ids detections",
            "hostile",
            "unknown",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "stop data",
            "typ url",
            "url data",
            "typ no",
            "th all",
            "stop",
            "port",
            "destination",
            "ds detections",
            "tls sni",
            "nrv2x",
            "upxoepplace",
            "alerts",
            "contacted",
            "markus",
            "hostile alerts",
            "less see",
            "all ip",
            "tulach",
            "brian sabey",
            "quasi",
            "link",
            "script urls",
            "record value",
            "script domains",
            "fireeye",
            "create c",
            "as15169",
            "next",
            "all url",
            "http",
            "related pulses",
            "related tags",
            "google safe",
            "code",
            "y se",
            "included review",
            "io excluded",
            "suggeste",
            "ipv4",
            "unknown ns",
            "redacted admin",
            "fax redacted",
            "name redacted",
            "phone redacted",
            "code redacted",
            "redacted tech",
            "christopher ahmann",
            "solarwinds like?"
          ],
          "references": [
            "asp.net \u2022 cdnsrc.asp.net",
            "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf",
            "http://www.phonefactor.com/PfPaWs/ConfirmActivation",
            "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting",
            "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo",
            "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c",
            "www.fireeye.com",
            "danilovstyle.ru",
            "ns4-04.azure-dns.info",
            "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info",
            "www.fireeye.com .",
            "https://hypic-anaivsis.com/sambrerb/a0p9veebo",
            "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.",
            "Tulach\u2019s ASP.Net Open Source destruction"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
              "display_name": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
              "target": "/malware/Ransom:Win32/SodinokibiCrypt.SK!MTB"
            },
            {
              "id": "Win.Ransomware.Tofsee-10015002",
              "display_name": "Win.Ransomware.Tofsee-10015002",
              "target": null
            },
            {
              "id": "Trojan:Win32/Comisproc!gmb I",
              "display_name": "Trojan:Win32/Comisproc!gmb I",
              "target": "/malware/Trojan:Win32/Comisproc!gmb I"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1132.001",
              "name": "Standard Encoding",
              "display_name": "T1132.001 - Standard Encoding"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 88,
            "FileHash-MD5": 211,
            "FileHash-SHA1": 186,
            "FileHash-SHA256": 1366,
            "URL": 1848,
            "domain": 418,
            "email": 4,
            "hostname": 622,
            "SSLCertFingerprint": 21
          },
          "indicator_count": 4764,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "5 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ddeb45c45f6a3cd721397d",
          "name": "Active attacks  \u2022 Apple \u2022 Tulach",
          "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
          "modified": "2026-04-14T07:22:45.250000",
          "created": "2026-04-14T07:22:45.250000",
          "tags": [
            "url http",
            "ipv4",
            "indicator role",
            "active related",
            "united",
            "moved",
            "gmt content",
            "certificate",
            "all domain",
            "msie",
            "chrome",
            "extraction",
            "data upload",
            "twitter",
            "cookie",
            "extra",
            "include data",
            "review locs",
            "exclude",
            "suggested os",
            "onlv",
            "failed",
            "stop data",
            "read c",
            "unicode",
            "rgba",
            "memcommit",
            "delete",
            "dock",
            "write",
            "execution",
            "sc type",
            "extri",
            "include review",
            "exclude sugges",
            "typ data",
            "a domains",
            "present apr",
            "script urls",
            "files",
            "files ip",
            "address",
            "ios",
            "mac",
            "apple",
            "appleid",
            "itunes",
            "next associated",
            "all ipv4",
            "included ic",
            "uny teade",
            "type hostnar",
            "hostnar hostnar",
            "hostnar",
            "macair",
            "macairaustralia",
            "ipad",
            "ipod",
            "cryptexportkey",
            "invalid pointer",
            "cryptgenkey",
            "stream",
            "defender",
            "delphi",
            "class",
            "stack",
            "format",
            "unknown",
            "united states",
            "phishing",
            "password",
            "traffic redirected",
            "service mod",
            "service execution",
            "youtube",
            "music",
            "streams",
            "songs",
            "played songs",
            "music streams",
            "most played",
            "fonelab",
            "indicator",
            "included iocs",
            "manually add",
            "review ocs",
            "exclude inn",
            "sugges data",
            "find",
            "include",
            "url https",
            "enter sc",
            "type",
            "no matchme",
            "search otx",
            "https",
            "references x",
            "analyze",
            "open th",
            "url data",
            "se http",
            "no match",
            "excluded iocs",
            "iocs",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "analysis date",
            "file score",
            "medium risk",
            "yara detections",
            "contacted",
            "related tags",
            "x vercel",
            "file type",
            "type indicator",
            "role title",
            "related pulses",
            "mulch virtua",
            "library loade",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugt",
            "samuel tulach",
            "unity engine",
            "tulach",
            "sa awareness",
            "sabey",
            "sar cut",
            "autofill",
            "includer review",
            "portiana oney",
            "targeting",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "musickit_1_.js",
            "lazarus",
            "injection",
            "CVE-2017-8570",
            "prefetch2",
            "target",
            "aaaa",
            "ip address",
            "record value",
            "emails",
            "samuel tuachs",
            "sapev",
            "review exclude",
            "monitored target",
            "script",
            "mitre att",
            "ascii text",
            "span",
            "path",
            "iframe",
            "april",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "body",
            "development att",
            "t1055.012 list planting",
            "active"
          ],
          "references": [
            "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
            "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
            "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
            "https://podcasts.apple.com/us/podcast/lazarus",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://help.aiseesoft.jp/blu-ray-player",
            "http://help.aiseesoft.jp/fonelab/",
            "https://action.aiseesoft.jp/itunes.php",
            "http://help.aiseesoft.jp/total-video-converter",
            "http://help.aiseesoft.jp/total-video-converter/",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
            "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
            "http://test-firstmile.digitecgalaxus.ch",
            "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
            "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
            "cdn.rss.applemarketingtools.com",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "1.bing.com.cn",
            "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
            "www.phantomcameras.cn",
            "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
            "podcasts.apple.com \u2022 23.34.32.21",
            "www.apple.com \u2022 23.34.32.199",
            "js-cdn.music.apple.com \u2022 23.78.51.170",
            "http://firstmile.digitecgalaxus.ch",
            "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
            "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
            "Tulach.cc",
            "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
            "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
            "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
            "asp.net domain pointer",
            "developer.x.com",
            "aotx.alienvault.com (aotx.?)",
            "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
            "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1020.001",
              "name": "Traffic Duplication",
              "display_name": "T1020.001 - Traffic Duplication"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591.002",
              "name": "Business Relationships",
              "display_name": "T1591.002 - Business Relationships"
            },
            {
              "id": "T1591.001",
              "name": "Determine Physical Locations",
              "display_name": "T1591.001 - Determine Physical Locations"
            },
            {
              "id": "T1585.001",
              "name": "Social Media Accounts",
              "display_name": "T1585.001 - Social Media Accounts"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1432",
              "name": "Access Contact List",
              "display_name": "T1432 - Access Contact List"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1029,
            "domain": 396,
            "email": 7,
            "URL": 2784,
            "FileHash-SHA256": 898,
            "FileHash-MD5": 79,
            "FileHash-SHA1": 68,
            "IPv4": 35,
            "CVE": 1,
            "SSLCertFingerprint": 13
          },
          "indicator_count": 5310,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "5 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692f23547b713b128b9c8156",
          "name": "Indicator Deletion Attack | Chris P. Ahmann Esq  still utilizes parking crews to execute cyber attacks",
          "description": "Unable to open malware indicators at this time. These attackers use Parking Crews for their exploits, leasing parked  domains for the amount of time needed to execute an attack. The attack last predate me ever using Level Blue. I have to review  indicators reports more closely but, I do see a the multitude of attacks against target TLB and an intersection of attacks concerning Disable_Duck (Alberta) Chris Ahmann , Colorado government indicated. \n\n[OTX auto populated - Adversaries may use techniques to evade detection in their malware or tools, as well as using techniques such as code signing, encryption, and other techniques for avoiding detection and monitoring of their activities.]",
          "modified": "2026-01-01T17:01:48.163000",
          "created": "2025-12-02T17:35:15.203000",
          "tags": [
            "data upload",
            "extraction",
            "failed",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "development att",
            "united",
            "flag",
            "poland poland",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "mitre att",
            "ck matrix",
            "pattern match",
            "ascii text",
            "show process",
            "network traffic",
            "t1057",
            "general",
            "local",
            "path",
            "encrypt",
            "hosts ip",
            "details",
            "ssl certificate",
            "sha256",
            "sha1",
            "size",
            "unicode text",
            "crlf",
            "utf8",
            "lf line",
            "server",
            "command decode",
            "markmonitor",
            "amazon",
            "ltd dba",
            "com laude",
            "organization",
            "click",
            "show technique",
            "brand",
            "microsoft edge",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "submitted",
            "prefetch1",
            "name server",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "contacted hosts",
            "google",
            "pornhub",
            "ip address",
            "t1480 execution",
            "file defense",
            "passive dns",
            "related nids",
            "urls",
            "files location",
            "flag united"
          ],
          "references": [
            "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
            "Amazon.com \u2022 Google.com \u2022YouTube.com, Apple.com ,  etc Exploited",
            "cloudendpointsapis.com \u2022 https://www.vgt.pl/style/style.css \u2022 ceidg.gov.pl",
            "pl.wikipedia.org \u2022  fontawesome.io \u2022  opensource.org \u2022 videojet.com",
            "https://discoverreceiver.gurus.vmicrosoft.com/ \u2022 account.live.com \u2022 acctcdn.msauth.net",
            "https://www.milehighmedia.com/legal/2257",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://twitter.com/PORNO_SEXYBABES",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \u2022 wallpapers-nature.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022",
            "https://wallpapers-nature.com/ tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/EntryChangeHistory.Id=7a025cc6",
            "(Delete app that removed YoiTube views) www.youtube.com/watch?v=GyuMozsVyYs",
            "http://watchhers.net/index.php",
            "everesttech.net \u2022 aws.amazon.com \u2022  cm.everesttech.net \u2022 dpm.demdex.net \u2022 s3.amazonaws.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1358,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 102,
            "FileHash-SHA256": 1682,
            "URL": 2497,
            "CVE": 2,
            "domain": 400,
            "SSLCertFingerprint": 6,
            "email": 3
          },
          "indicator_count": 6150,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68feb98a8c1b75b4431a3e8e",
          "name": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator?",
          "description": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator? 1.) (userlolxxl)  is also disable_duck, has an unhealthy interest in the Tsara Brashears \u2018dead yet\u2019 theory , has many profiles. His issues are self made by grabbing vulnerabilities found and linking them to a fake University website. We checked. Profile belongs to a group causing needless distraction and hooking users into the \u2018No Problems\u2019 group. \n\nWe swiftly got Regis University to take notice of Palantirs Prometheus Intelligence Technology tracking. Dean let semester begin putting students at risk despite warnings from Tsara Brashears of owa canary cookie in server, to replace computers , halt school , deal with issue. RU ignored issues,  Brashears didn\u2019t. They went black , blacklisted Tsara  warning of credible death threats on dark web.",
          "modified": "2025-11-25T20:05:31.749000",
          "created": "2025-10-27T00:15:06.191000",
          "tags": [
            "html internet",
            "html document",
            "ascii text",
            "language",
            "cve202323397",
            "iframe tags",
            "tag manager",
            "gtmkvjvztk",
            "anchor hrefs",
            "info ta0011",
            "protocol",
            "layer protocol",
            "port",
            "t1571 encrypted",
            "channel",
            "t1573 malware",
            "tree",
            "oc0006 http",
            "c0014",
            "get http",
            "dns resolutions",
            "resolved ips",
            "user",
            "data",
            "datacrashpad",
            "edge",
            "v full",
            "reports v",
            "chrome u",
            "appdata local",
            "googlechrome u",
            "u ser",
            "cname",
            "ip address",
            "http",
            "accept",
            "network dropped",
            "duration cuckoo",
            "version file",
            "machine label",
            "shutdown",
            "extraction",
            "suggested iocs",
            "data upload",
            "cry dee",
            "stop",
            "type",
            "url indicator",
            "enter",
            "failed",
            "se share",
            "extrac",
            "enter so",
            "passive dns",
            "urls",
            "hostname add",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as20473",
            "dynamicloader",
            "directui",
            "write c",
            "intel",
            "ms windows",
            "pe32",
            "element",
            "delete c",
            "document file",
            "v2 document",
            "explorer",
            "trojandropper",
            "write",
            "markus",
            "august",
            "movie",
            "insert",
            "pulse submit",
            "url analysis",
            "asn as8068",
            "united",
            "entries",
            "body",
            "please",
            "x msedge",
            "ipv4 add",
            "present sep",
            "present oct",
            "present feb",
            "status",
            "unknown ns",
            "search",
            "name servers",
            "present jul",
            "aaaa",
            "present apr",
            "trojan",
            "medium",
            "high",
            "yara rule",
            "globalc",
            "june",
            "malware",
            "win64",
            "unknown",
            "america flag",
            "twitter",
            "hostname",
            "domain add",
            "reverse dns",
            "america asn",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "unknown aaaa",
            "title",
            "meta",
            "window",
            "encrypt",
            "pulse indicator",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "atlanta",
            "abuse",
            "agent",
            "service",
            "present jun",
            "present may",
            "creation date",
            "record value",
            "servers",
            "libretv meta",
            "certificate",
            "value",
            "whois lookup",
            "loopia ab",
            "userlolxxl"
          ],
          "references": [
            "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
            "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
            "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
            "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
            "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
            "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
            "https://hs.ecam.com/your-challenges-ecams-solutions",
            "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
            "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
            "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Wannacry",
              "display_name": "Wannacry",
              "target": null
            },
            {
              "id": "Foundry",
              "display_name": "Foundry",
              "target": null
            },
            {
              "id": "Trojan:Win32/Comisproc!gmb",
              "display_name": "Trojan:Win32/Comisproc!gmb",
              "target": "/malware/Trojan:Win32/Comisproc!gmb"
            },
            {
              "id": "Trojandropper:Win32/VB.IL",
              "display_name": "Trojandropper:Win32/VB.IL",
              "target": "/malware/Trojandropper:Win32/VB.IL"
            },
            {
              "id": "#Exploit:Win32/CVE- 2023 - 23397",
              "display_name": "#Exploit:Win32/CVE- 2023 - 23397",
              "target": "/malware/#Exploit:Win32/CVE- 2023 - 23397"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "ALF:PulZati:Worm:Win32/Mydoom",
              "display_name": "ALF:PulZati:Worm:Win32/Mydoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 8,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 248,
            "FileHash-SHA1": 134,
            "FileHash-SHA256": 2661,
            "URL": 6257,
            "domain": 682,
            "email": 8,
            "hostname": 2077,
            "CVE": 1
          },
          "indicator_count": 12068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "145 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68a23eef53f1124e8dc273fc",
          "name": "Sign in to your account - Anorocuriv",
          "description": "Short link sent to an iPhone user possibly by accident or maybe not. Unraveled :[https://ns4.whichkill.net/]\n[https://l.us-1.a.mimecastprotect.com/l]\n[https://api-glintstage.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\n\n[https://api.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\t\n\n*api.us1.glintinc.com #malta\n*ALF:Trojan:Win32/Anorocuriv.A.#virtool #LowFI:HookwowLow \n#tracking #tiaa #locate recording #userpics #movies #audio #screen #mobile_assets #https://biccerija.gov.mt/en/contact/",
          "modified": "2025-09-16T20:00:00.565000",
          "created": "2025-08-17T20:43:27.502000",
          "tags": [
            "url http",
            "url https",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "entries",
            "status",
            "msie",
            "chrome",
            "passive dns",
            "urls",
            "date",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "body",
            "http",
            "hostname",
            "files domain",
            "present jan",
            "present dec",
            "united",
            "present aug",
            "present jun",
            "unknown aaaa",
            "present mar",
            "present may",
            "present feb",
            "present jul",
            "error",
            "a domains",
            "gmt content",
            "accept encoding",
            "config nocache",
            "hostname add",
            "pulse submit",
            "content type",
            "certificate",
            "ip address",
            "cookie",
            "mita",
            "next associated",
            "please",
            "x msedge",
            "ipv4 add",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "size",
            "pattern match",
            "mitre att",
            "ascii text",
            "null",
            "click",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "meta",
            "onload",
            "span",
            "adversaries",
            "ssl certificate",
            "logo",
            "av detection",
            "default browser",
            "guest system",
            "professional",
            "falcon sandbox",
            "response risk",
            "ck techniques",
            "detection",
            "show process",
            "prefetch8",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "post collect",
            "microsoft edge",
            "nota",
            "brand",
            "class",
            "facebook",
            "ascii",
            "hex dump",
            "extraction",
            "failed",
            "data upload",
            "pul data",
            "enter",
            "s data",
            "type",
            "extr error",
            "href",
            "mask",
            "extra",
            "uta support",
            "include review",
            "exclude sugges",
            "find",
            "wow64",
            "show",
            "observed dns",
            "query",
            "unknown",
            "virtool",
            "copy",
            "write",
            "defender",
            "expiro",
            "malware",
            "next",
            "lowfi",
            "hookwowlow dec",
            "mtb jan",
            "mtb nov",
            "hookwowlow nov",
            "trojan",
            "trojandropper",
            "http request",
            "delete",
            "yara detections",
            "pe exe",
            "dll windows",
            "minimal http",
            "february",
            "guard",
            "alerts",
            "analysis date",
            "file score",
            "detections alf",
            "detections http",
            "http executable",
            "retrieved",
            "location united",
            "america flag",
            "america asn",
            "urls show",
            "date checked",
            "url hostname",
            "server response"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 853,
            "hostname": 1835,
            "URL": 7127,
            "email": 3,
            "FileHash-SHA256": 1470,
            "FileHash-MD5": 293,
            "FileHash-SHA1": 284,
            "SSLCertFingerprint": 426,
            "CVE": 1
          },
          "indicator_count": 12292,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "215 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "danilovstyle.ru",
        "everesttech.net \u2022 aws.amazon.com \u2022  cm.everesttech.net \u2022 dpm.demdex.net \u2022 s3.amazonaws.com",
        "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf",
        "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "ns4-04.azure-dns.info",
        "http://help.aiseesoft.jp/total-video-converter/",
        "http://firstmile.digitecgalaxus.ch",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "cloudendpointsapis.com \u2022 https://www.vgt.pl/style/style.css \u2022 ceidg.gov.pl",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "https://hs.ecam.com/your-challenges-ecams-solutions",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
        "https://hypic-anaivsis.com/sambrerb/a0p9veebo",
        "https://www.milehighmedia.com/legal/2257",
        "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
        "cdn.rss.applemarketingtools.com",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "developer.x.com",
        "1.bing.com.cn",
        "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022",
        "https://discoverreceiver.gurus.vmicrosoft.com/ \u2022 account.live.com \u2022 acctcdn.msauth.net",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting",
        "http://watchhers.net/index.php",
        "pl.wikipedia.org \u2022  fontawesome.io \u2022  opensource.org \u2022 videojet.com",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
        "https://twitter.com/PORNO_SEXYBABES",
        "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
        "www.phantomcameras.cn",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/EntryChangeHistory.Id=7a025cc6",
        "http://help.aiseesoft.jp/total-video-converter",
        "podcasts.apple.com \u2022 23.34.32.21",
        "asp.net \u2022 cdnsrc.asp.net",
        "Tulach\u2019s ASP.Net Open Source destruction",
        "Amazon.com \u2022 Google.com \u2022YouTube.com, Apple.com ,  etc Exploited",
        "aotx.alienvault.com (aotx.?)",
        "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "http://test-firstmile.digitecgalaxus.ch",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info",
        "http://www.phonefactor.com/PfPaWs/ConfirmActivation",
        "(Delete app that removed YoiTube views) www.youtube.com/watch?v=GyuMozsVyYs",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
        "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
        "https://action.aiseesoft.jp/itunes.php",
        "www.fireeye.com",
        "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "http://help.aiseesoft.jp/blu-ray-player",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \u2022 wallpapers-nature.com",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "asp.net domain pointer",
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "http://help.aiseesoft.jp/fonelab/",
        "www.apple.com \u2022 23.34.32.199",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "www.fireeye.com .",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "Tulach.cc",
        "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/ tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Pegasus",
            "Foundry",
            "Trojan:win32/comisproc!gmb",
            "Trojan:win32/comisproc!gmb i",
            "#exploit:win32/cve- 2023 - 23397",
            "Cve-2023-22518",
            "Win.ransomware.tofsee-10015002",
            "Other malware",
            "Trojandropper:win32/vb.il",
            "Alf:pulzati:worm:win32/mydoom",
            "Ransom:win32/sodinokibicrypt.sk!mtb",
            "Wannacry"
          ],
          "industries": [],
          "unique_indicators": 38514
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/jorsin.se",
    "whois": "http://whois.domaintools.com/jorsin.se",
    "domain": "jorsin.se",
    "hostname": "devblog.jorsin.se"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69decb6dd1bd6da78fc72d0a",
      "name": "Solarwinds Similarties? Tactics ASP.Net IoC\u2019s ISOLATED",
      "description": "Does this have similarities to the SolarWinds Attack? Anyone?\n\nASP.NET is a web application framework created by Microsoft for building dynamic web applications.\nIt enables developers to create web pages that can interact with databases and respond to user inputs.\nASP.NET supports various programming languages, including C# and VB.NET.\nContext: ASP.NET is widely used for developing modern web applications and services. It allows developers to create interactive and data-driven web pages that can run on various operating systems, including Windows, Linux, and macOS. The framework is open-source and supports various architectures, including MVC (Model-View-Controller) and Web API, which facilitate the organization and development of complex applications.\nIn many instances ASP.net has been seen connected to malicious Tulach , Apple , a browser agent that transmits data to New Relic's collectors by using either of the domains bam.nr-data.net or bam-cell.nr-data.net.",
      "modified": "2026-04-14T23:19:09.495000",
      "created": "2026-04-14T23:19:09.495000",
      "tags": [
        "united",
        "aaaa",
        "certificate",
        "error",
        "read c",
        "rgba",
        "unicode",
        "memcommit",
        "delete",
        "dock",
        "execution",
        "command decode",
        "suricata ipv4",
        "suricata tcpv4",
        "flag",
        "localappdata",
        "windir",
        "openurl c",
        "programfiles",
        "suricata udpv4",
        "win64",
        "click",
        "strings",
        "anon",
        "username",
        "userprofile",
        "mitre att",
        "ck id",
        "ck matrix",
        "appdata",
        "comspec",
        "model",
        "path",
        "april",
        "hybrid",
        "general",
        "learn",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ck techniques",
        "mtb apr",
        "exploit",
        "trojan",
        "backdoor",
        "please",
        "x msedge",
        "all ipv4",
        "ransom",
        "date hash",
        "avast avg",
        "win32orbus apr",
        "dynamicloader",
        "yara rule",
        "high",
        "tofsee",
        "rndhex",
        "rndchar",
        "loaderid",
        "lidfileupd",
        "localcfg",
        "write",
        "stream",
        "push",
        "mtb alerts",
        "ee fc",
        "ff d5",
        "lredmond",
        "malware",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "yara detections",
        "av detections",
        "ids detections",
        "hostile",
        "unknown",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "stop data",
        "typ url",
        "url data",
        "typ no",
        "th all",
        "stop",
        "port",
        "destination",
        "ds detections",
        "tls sni",
        "nrv2x",
        "upxoepplace",
        "alerts",
        "contacted",
        "markus",
        "hostile alerts",
        "less see",
        "all ip",
        "tulach",
        "brian sabey",
        "quasi",
        "link",
        "script urls",
        "record value",
        "script domains",
        "fireeye",
        "create c",
        "as15169",
        "next",
        "all url",
        "http",
        "related pulses",
        "related tags",
        "google safe",
        "code",
        "y se",
        "included review",
        "io excluded",
        "suggeste",
        "ipv4",
        "unknown ns",
        "redacted admin",
        "fax redacted",
        "name redacted",
        "phone redacted",
        "code redacted",
        "redacted tech",
        "christopher ahmann",
        "solarwinds like?"
      ],
      "references": [
        "asp.net \u2022 cdnsrc.asp.net",
        "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf",
        "http://www.phonefactor.com/PfPaWs/ConfirmActivation",
        "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting",
        "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo",
        "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c",
        "www.fireeye.com",
        "danilovstyle.ru",
        "ns4-04.azure-dns.info",
        "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info",
        "www.fireeye.com .",
        "https://hypic-anaivsis.com/sambrerb/a0p9veebo",
        "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.",
        "Tulach\u2019s ASP.Net Open Source destruction"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
          "display_name": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
          "target": "/malware/Ransom:Win32/SodinokibiCrypt.SK!MTB"
        },
        {
          "id": "Win.Ransomware.Tofsee-10015002",
          "display_name": "Win.Ransomware.Tofsee-10015002",
          "target": null
        },
        {
          "id": "Trojan:Win32/Comisproc!gmb I",
          "display_name": "Trojan:Win32/Comisproc!gmb I",
          "target": "/malware/Trojan:Win32/Comisproc!gmb I"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1132.001",
          "name": "Standard Encoding",
          "display_name": "T1132.001 - Standard Encoding"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 88,
        "FileHash-MD5": 211,
        "FileHash-SHA1": 186,
        "FileHash-SHA256": 1366,
        "URL": 1848,
        "domain": 418,
        "email": 4,
        "hostname": 622,
        "SSLCertFingerprint": 21
      },
      "indicator_count": 4764,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "5 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ddeb45c45f6a3cd721397d",
      "name": "Active attacks  \u2022 Apple \u2022 Tulach",
      "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
      "modified": "2026-04-14T07:22:45.250000",
      "created": "2026-04-14T07:22:45.250000",
      "tags": [
        "url http",
        "ipv4",
        "indicator role",
        "active related",
        "united",
        "moved",
        "gmt content",
        "certificate",
        "all domain",
        "msie",
        "chrome",
        "extraction",
        "data upload",
        "twitter",
        "cookie",
        "extra",
        "include data",
        "review locs",
        "exclude",
        "suggested os",
        "onlv",
        "failed",
        "stop data",
        "read c",
        "unicode",
        "rgba",
        "memcommit",
        "delete",
        "dock",
        "write",
        "execution",
        "sc type",
        "extri",
        "include review",
        "exclude sugges",
        "typ data",
        "a domains",
        "present apr",
        "script urls",
        "files",
        "files ip",
        "address",
        "ios",
        "mac",
        "apple",
        "appleid",
        "itunes",
        "next associated",
        "all ipv4",
        "included ic",
        "uny teade",
        "type hostnar",
        "hostnar hostnar",
        "hostnar",
        "macair",
        "macairaustralia",
        "ipad",
        "ipod",
        "cryptexportkey",
        "invalid pointer",
        "cryptgenkey",
        "stream",
        "defender",
        "delphi",
        "class",
        "stack",
        "format",
        "unknown",
        "united states",
        "phishing",
        "password",
        "traffic redirected",
        "service mod",
        "service execution",
        "youtube",
        "music",
        "streams",
        "songs",
        "played songs",
        "music streams",
        "most played",
        "fonelab",
        "indicator",
        "included iocs",
        "manually add",
        "review ocs",
        "exclude inn",
        "sugges data",
        "find",
        "include",
        "url https",
        "enter sc",
        "type",
        "no matchme",
        "search otx",
        "https",
        "references x",
        "analyze",
        "open th",
        "url data",
        "se http",
        "no match",
        "excluded iocs",
        "iocs",
        "ip whitelisted",
        "whitelisted",
        "tcp include",
        "analysis date",
        "file score",
        "medium risk",
        "yara detections",
        "contacted",
        "related tags",
        "x vercel",
        "file type",
        "type indicator",
        "role title",
        "related pulses",
        "mulch virtua",
        "library loade",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugt",
        "samuel tulach",
        "unity engine",
        "tulach",
        "sa awareness",
        "sabey",
        "sar cut",
        "autofill",
        "includer review",
        "portiana oney",
        "targeting",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "musickit_1_.js",
        "lazarus",
        "injection",
        "CVE-2017-8570",
        "prefetch2",
        "target",
        "aaaa",
        "ip address",
        "record value",
        "emails",
        "samuel tuachs",
        "sapev",
        "review exclude",
        "monitored target",
        "script",
        "mitre att",
        "ascii text",
        "span",
        "path",
        "iframe",
        "april",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "body",
        "development att",
        "t1055.012 list planting",
        "active"
      ],
      "references": [
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://help.aiseesoft.jp/blu-ray-player",
        "http://help.aiseesoft.jp/fonelab/",
        "https://action.aiseesoft.jp/itunes.php",
        "http://help.aiseesoft.jp/total-video-converter",
        "http://help.aiseesoft.jp/total-video-converter/",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "http://test-firstmile.digitecgalaxus.ch",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "cdn.rss.applemarketingtools.com",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "1.bing.com.cn",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "www.phantomcameras.cn",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "podcasts.apple.com \u2022 23.34.32.21",
        "www.apple.com \u2022 23.34.32.199",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "http://firstmile.digitecgalaxus.ch",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "Tulach.cc",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "asp.net domain pointer",
        "developer.x.com",
        "aotx.alienvault.com (aotx.?)",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1020.001",
          "name": "Traffic Duplication",
          "display_name": "T1020.001 - Traffic Duplication"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591.002",
          "name": "Business Relationships",
          "display_name": "T1591.002 - Business Relationships"
        },
        {
          "id": "T1591.001",
          "name": "Determine Physical Locations",
          "display_name": "T1591.001 - Determine Physical Locations"
        },
        {
          "id": "T1585.001",
          "name": "Social Media Accounts",
          "display_name": "T1585.001 - Social Media Accounts"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1432",
          "name": "Access Contact List",
          "display_name": "T1432 - Access Contact List"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1029,
        "domain": 396,
        "email": 7,
        "URL": 2784,
        "FileHash-SHA256": 898,
        "FileHash-MD5": 79,
        "FileHash-SHA1": 68,
        "IPv4": 35,
        "CVE": 1,
        "SSLCertFingerprint": 13
      },
      "indicator_count": 5310,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "5 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692f23547b713b128b9c8156",
      "name": "Indicator Deletion Attack | Chris P. Ahmann Esq  still utilizes parking crews to execute cyber attacks",
      "description": "Unable to open malware indicators at this time. These attackers use Parking Crews for their exploits, leasing parked  domains for the amount of time needed to execute an attack. The attack last predate me ever using Level Blue. I have to review  indicators reports more closely but, I do see a the multitude of attacks against target TLB and an intersection of attacks concerning Disable_Duck (Alberta) Chris Ahmann , Colorado government indicated. \n\n[OTX auto populated - Adversaries may use techniques to evade detection in their malware or tools, as well as using techniques such as code signing, encryption, and other techniques for avoiding detection and monitoring of their activities.]",
      "modified": "2026-01-01T17:01:48.163000",
      "created": "2025-12-02T17:35:15.203000",
      "tags": [
        "data upload",
        "extraction",
        "failed",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "development att",
        "united",
        "flag",
        "poland poland",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "mitre att",
        "ck matrix",
        "pattern match",
        "ascii text",
        "show process",
        "network traffic",
        "t1057",
        "general",
        "local",
        "path",
        "encrypt",
        "hosts ip",
        "details",
        "ssl certificate",
        "sha256",
        "sha1",
        "size",
        "unicode text",
        "crlf",
        "utf8",
        "lf line",
        "server",
        "command decode",
        "markmonitor",
        "amazon",
        "ltd dba",
        "com laude",
        "organization",
        "click",
        "show technique",
        "brand",
        "microsoft edge",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "submitted",
        "prefetch1",
        "name server",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "contacted hosts",
        "google",
        "pornhub",
        "ip address",
        "t1480 execution",
        "file defense",
        "passive dns",
        "related nids",
        "urls",
        "files location",
        "flag united"
      ],
      "references": [
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
        "Amazon.com \u2022 Google.com \u2022YouTube.com, Apple.com ,  etc Exploited",
        "cloudendpointsapis.com \u2022 https://www.vgt.pl/style/style.css \u2022 ceidg.gov.pl",
        "pl.wikipedia.org \u2022  fontawesome.io \u2022  opensource.org \u2022 videojet.com",
        "https://discoverreceiver.gurus.vmicrosoft.com/ \u2022 account.live.com \u2022 acctcdn.msauth.net",
        "https://www.milehighmedia.com/legal/2257",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://twitter.com/PORNO_SEXYBABES",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \u2022 wallpapers-nature.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022",
        "https://wallpapers-nature.com/ tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/EntryChangeHistory.Id=7a025cc6",
        "(Delete app that removed YoiTube views) www.youtube.com/watch?v=GyuMozsVyYs",
        "http://watchhers.net/index.php",
        "everesttech.net \u2022 aws.amazon.com \u2022  cm.everesttech.net \u2022 dpm.demdex.net \u2022 s3.amazonaws.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1358,
        "FileHash-MD5": 100,
        "FileHash-SHA1": 102,
        "FileHash-SHA256": 1682,
        "URL": 2497,
        "CVE": 2,
        "domain": 400,
        "SSLCertFingerprint": 6,
        "email": 3
      },
      "indicator_count": 6150,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68feb98a8c1b75b4431a3e8e",
      "name": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator?",
      "description": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator? 1.) (userlolxxl)  is also disable_duck, has an unhealthy interest in the Tsara Brashears \u2018dead yet\u2019 theory , has many profiles. His issues are self made by grabbing vulnerabilities found and linking them to a fake University website. We checked. Profile belongs to a group causing needless distraction and hooking users into the \u2018No Problems\u2019 group. \n\nWe swiftly got Regis University to take notice of Palantirs Prometheus Intelligence Technology tracking. Dean let semester begin putting students at risk despite warnings from Tsara Brashears of owa canary cookie in server, to replace computers , halt school , deal with issue. RU ignored issues,  Brashears didn\u2019t. They went black , blacklisted Tsara  warning of credible death threats on dark web.",
      "modified": "2025-11-25T20:05:31.749000",
      "created": "2025-10-27T00:15:06.191000",
      "tags": [
        "html internet",
        "html document",
        "ascii text",
        "language",
        "cve202323397",
        "iframe tags",
        "tag manager",
        "gtmkvjvztk",
        "anchor hrefs",
        "info ta0011",
        "protocol",
        "layer protocol",
        "port",
        "t1571 encrypted",
        "channel",
        "t1573 malware",
        "tree",
        "oc0006 http",
        "c0014",
        "get http",
        "dns resolutions",
        "resolved ips",
        "user",
        "data",
        "datacrashpad",
        "edge",
        "v full",
        "reports v",
        "chrome u",
        "appdata local",
        "googlechrome u",
        "u ser",
        "cname",
        "ip address",
        "http",
        "accept",
        "network dropped",
        "duration cuckoo",
        "version file",
        "machine label",
        "shutdown",
        "extraction",
        "suggested iocs",
        "data upload",
        "cry dee",
        "stop",
        "type",
        "url indicator",
        "enter",
        "failed",
        "se share",
        "extrac",
        "enter so",
        "passive dns",
        "urls",
        "hostname add",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as20473",
        "dynamicloader",
        "directui",
        "write c",
        "intel",
        "ms windows",
        "pe32",
        "element",
        "delete c",
        "document file",
        "v2 document",
        "explorer",
        "trojandropper",
        "write",
        "markus",
        "august",
        "movie",
        "insert",
        "pulse submit",
        "url analysis",
        "asn as8068",
        "united",
        "entries",
        "body",
        "please",
        "x msedge",
        "ipv4 add",
        "present sep",
        "present oct",
        "present feb",
        "status",
        "unknown ns",
        "search",
        "name servers",
        "present jul",
        "aaaa",
        "present apr",
        "trojan",
        "medium",
        "high",
        "yara rule",
        "globalc",
        "june",
        "malware",
        "win64",
        "unknown",
        "america flag",
        "twitter",
        "hostname",
        "domain add",
        "reverse dns",
        "america asn",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "unknown aaaa",
        "title",
        "meta",
        "window",
        "encrypt",
        "pulse indicator",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "atlanta",
        "abuse",
        "agent",
        "service",
        "present jun",
        "present may",
        "creation date",
        "record value",
        "servers",
        "libretv meta",
        "certificate",
        "value",
        "whois lookup",
        "loopia ab",
        "userlolxxl"
      ],
      "references": [
        "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
        "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
        "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
        "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
        "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
        "https://hs.ecam.com/your-challenges-ecams-solutions",
        "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
        "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
        "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Wannacry",
          "display_name": "Wannacry",
          "target": null
        },
        {
          "id": "Foundry",
          "display_name": "Foundry",
          "target": null
        },
        {
          "id": "Trojan:Win32/Comisproc!gmb",
          "display_name": "Trojan:Win32/Comisproc!gmb",
          "target": "/malware/Trojan:Win32/Comisproc!gmb"
        },
        {
          "id": "Trojandropper:Win32/VB.IL",
          "display_name": "Trojandropper:Win32/VB.IL",
          "target": "/malware/Trojandropper:Win32/VB.IL"
        },
        {
          "id": "#Exploit:Win32/CVE- 2023 - 23397",
          "display_name": "#Exploit:Win32/CVE- 2023 - 23397",
          "target": "/malware/#Exploit:Win32/CVE- 2023 - 23397"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "ALF:PulZati:Worm:Win32/Mydoom",
          "display_name": "ALF:PulZati:Worm:Win32/Mydoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 8,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 248,
        "FileHash-SHA1": 134,
        "FileHash-SHA256": 2661,
        "URL": 6257,
        "domain": 682,
        "email": 8,
        "hostname": 2077,
        "CVE": 1
      },
      "indicator_count": 12068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "145 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68a23eef53f1124e8dc273fc",
      "name": "Sign in to your account - Anorocuriv",
      "description": "Short link sent to an iPhone user possibly by accident or maybe not. Unraveled :[https://ns4.whichkill.net/]\n[https://l.us-1.a.mimecastprotect.com/l]\n[https://api-glintstage.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\n\n[https://api.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\t\n\n*api.us1.glintinc.com #malta\n*ALF:Trojan:Win32/Anorocuriv.A.#virtool #LowFI:HookwowLow \n#tracking #tiaa #locate recording #userpics #movies #audio #screen #mobile_assets #https://biccerija.gov.mt/en/contact/",
      "modified": "2025-09-16T20:00:00.565000",
      "created": "2025-08-17T20:43:27.502000",
      "tags": [
        "url http",
        "url https",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "entries",
        "status",
        "msie",
        "chrome",
        "passive dns",
        "urls",
        "date",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "body",
        "http",
        "hostname",
        "files domain",
        "present jan",
        "present dec",
        "united",
        "present aug",
        "present jun",
        "unknown aaaa",
        "present mar",
        "present may",
        "present feb",
        "present jul",
        "error",
        "a domains",
        "gmt content",
        "accept encoding",
        "config nocache",
        "hostname add",
        "pulse submit",
        "content type",
        "certificate",
        "ip address",
        "cookie",
        "mita",
        "next associated",
        "please",
        "x msedge",
        "ipv4 add",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "size",
        "pattern match",
        "mitre att",
        "ascii text",
        "null",
        "click",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "meta",
        "onload",
        "span",
        "adversaries",
        "ssl certificate",
        "logo",
        "av detection",
        "default browser",
        "guest system",
        "professional",
        "falcon sandbox",
        "response risk",
        "ck techniques",
        "detection",
        "show process",
        "prefetch8",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "post collect",
        "microsoft edge",
        "nota",
        "brand",
        "class",
        "facebook",
        "ascii",
        "hex dump",
        "extraction",
        "failed",
        "data upload",
        "pul data",
        "enter",
        "s data",
        "type",
        "extr error",
        "href",
        "mask",
        "extra",
        "uta support",
        "include review",
        "exclude sugges",
        "find",
        "wow64",
        "show",
        "observed dns",
        "query",
        "unknown",
        "virtool",
        "copy",
        "write",
        "defender",
        "expiro",
        "malware",
        "next",
        "lowfi",
        "hookwowlow dec",
        "mtb jan",
        "mtb nov",
        "hookwowlow nov",
        "trojan",
        "trojandropper",
        "http request",
        "delete",
        "yara detections",
        "pe exe",
        "dll windows",
        "minimal http",
        "february",
        "guard",
        "alerts",
        "analysis date",
        "file score",
        "detections alf",
        "detections http",
        "http executable",
        "retrieved",
        "location united",
        "america flag",
        "america asn",
        "urls show",
        "date checked",
        "url hostname",
        "server response"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 853,
        "hostname": 1835,
        "URL": 7127,
        "email": 3,
        "FileHash-SHA256": 1470,
        "FileHash-MD5": 293,
        "FileHash-SHA1": 284,
        "SSLCertFingerprint": 426,
        "CVE": 1
      },
      "indicator_count": 12292,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "215 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://devblog.jorsin.se/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://devblog.jorsin.se/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776643838.2196548
}