{
  "type": "URL",
  "indicator": "https://director.cloud.minely.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://director.cloud.minely.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3144856259,
      "indicator": "https://director.cloud.minely.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "68bbdb22e3d606ae8fb5cda8",
          "name": "HCPF | Department of Health Care Policy and Financing",
          "description": "Project Nemesis - Affects Department of Health Care Policy and Financing | Family representative  repeatedly told past bills aren\u2019t being paid by United Healthcare. Argus Insurance (unknown entity) was Policy on record target never had. FR was given information regarding HCPF which was being viewed by past vendor seen in (https://otx.alienvault.com/pulse/68bbb31f6d91989d7fcd9592) |  Issues with HCPF have been an issue for some time in isolated scenarios. It\u2019s unclear how at least one person keeps getting their name, bills and life pulled into this. Target PURCHASED a Healthcare policy via agent before major social engineering attacks. Same entity literally robs targets. Gift cards, phone services, cloud storage, account, insurance policies, bank account access, tax refunds, paid claims reversed & taken from target\u2019s account.\nMore research needed. Flaws  in new system could jeopardize many. \n#trulymissed #rip #techbrohell #palantir",
          "modified": "2025-10-06T05:01:18.794000",
          "created": "2025-09-06T06:56:34.649000",
          "tags": [
            "federal changes",
            "health first",
            "colorado",
            "child health",
            "plan plus",
            "newimpact",
            "medicaidour",
            "impact",
            "medicaid page",
            "medicaid",
            "beware",
            "text/html",
            "trackers",
            "iframes",
            "external-resources",
            "new relic",
            "g1gv3h3sxc0",
            "utc gcw970gh4gg",
            "android",
            "known exploited",
            "google",
            "salesloft drift",
            "sap s4hana",
            "cve202542957",
            "cisa",
            "sitecore",
            "linux",
            "france",
            "meta",
            "rokrat",
            "lizar",
            "project nemesis",
            "carbanak",
            "cobalt strike",
            "domino",
            "no expiration",
            "url https",
            "type indicator",
            "role title",
            "related pulses",
            "hostname https",
            "m4e5930",
            "hostname",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "ascii text",
            "search",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "dock",
            "write",
            "capture",
            "persistence",
            "malware",
            "roboto",
            "present feb",
            "united",
            "a domains",
            "present dec",
            "passive dns",
            "moved",
            "script domains",
            "script urls",
            "urls",
            "title",
            "date",
            "resolved ips",
            "http traffic",
            "http get",
            "match info",
            "downloads",
            "info",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "protocol t1095",
            "endgame systems"
          ],
          "references": [
            "Researched: https://hcpf.colorado.gov/",
            "www.onyx-ware.com \u2022 https://www.endgamesystems.com/",
            "millet-usgc-1.palantirfedstart.com",
            "https://securityaffairs.com/109671/hacking/50000-home-cameras-hacked.html",
            "https://passwords.google/?utm_medium=hpp&utm_source=google&utm_campaign=sid2023aunonenms",
            "https://passwords.google/?utm_medium=hpp&utm",
            "https://securityaffairs.com/181338/security/google-fixed-chrome-flaw-found-by-big-sleep-ai.html",
            "Researched publicly available information provided by representative of a target\u2019s estate",
            "System has placed affected on multiple policies cancelling private policy without notice.",
            "Paid for plan long after entity put target on a state plan. Target audited for making too much money (framed)",
            "Provided documented evidence of appealed state issued plan and disclosed financials.",
            "Won appeal. Denied stimulus until passing another audit showing taxable income and filed taxes",
            "I hope this goes smoothly. I believe will be a nightmare as witnessed. I hope I\u2019m wrong.",
            "State (or random \u2022_- hackers) erased evidence of targets insurance all paid for by target.",
            "Target also owned an online brokerage & lead company, was agent & insurance marketer for years.",
            "September began with false information, defaulted claims , denials from authorized  services rendered years prior.",
            "If someone has Medicare it\u2019s wise to check with carrier & providers to see policies generated by AI"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lizar",
              "display_name": "Lizar",
              "target": null
            },
            {
              "id": "Project Nemesis",
              "display_name": "Project Nemesis",
              "target": null
            },
            {
              "id": "Carbanak",
              "display_name": "Carbanak",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Domino",
              "display_name": "Domino",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [
            "Hospitality",
            "Financial",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1395,
            "URL": 4304,
            "CVE": 1,
            "domain": 694,
            "FileHash-SHA256": 1790,
            "FileHash-MD5": 183,
            "FileHash-SHA1": 103,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 8475,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "195 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570803fe514ca975b6db5cb",
          "name": "Clarityelections.com",
          "description": "",
          "modified": "2023-12-06T14:07:59.920000",
          "created": "2023-12-06T14:07:59.920000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 346,
            "hostname": 2735,
            "URL": 6827,
            "domain": 1384,
            "email": 1
          },
          "indicator_count": 11293,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "642eac06b2963a871b0fdd45",
          "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection",
          "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m",
          "modified": "2023-05-06T10:00:48.707000",
          "created": "2023-04-06T11:24:54.313000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "dropped file",
            "runtime data",
            "chromeua",
            "span",
            "optout",
            "pcap processing",
            "pattern match",
            "script",
            "click",
            "date",
            "middle",
            "null",
            "april",
            "twitter",
            "body",
            "error",
            "jackson",
            "desktop",
            "service",
            "bill",
            "heat",
            "webview",
            "cruise",
            "blank",
            "meta",
            "night",
            "false",
            "contact",
            "suspicious",
            "facebook",
            "close",
            "cannon",
            "mayberry",
            "santana",
            "comment",
            "flex",
            "karma",
            "nightmare",
            "find",
            "spacer",
            "kitty",
            "mike",
            "local",
            "already",
            "soldier",
            "wallpaper",
            "story",
            "generic",
            "tiny",
            "trident",
            "android",
            "hybrid",
            "general",
            "hosts",
            "favorite",
            "homepage",
            "music",
            "code",
            "push",
            "strings",
            "malicious",
            "qakbot",
            "25px",
            "60px",
            "24px",
            "100px",
            "1439px",
            "segoe ui",
            "roboto",
            "path",
            "chat",
            "form",
            "embed",
            "unknown",
            "live",
            "network",
            "unicode",
            "feed",
            "5000",
            "next",
            "fullscreen",
            "iframe",
            "latv",
            "latino voices",
            "localappdata",
            "latino",
            "noscript",
            "pragma",
            "this",
            "hybrid analysis",
            "programfiles",
            "input",
            "wilstaging02",
            "potential ip"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
            "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
            "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
            "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
            "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1291,
            "email": 13,
            "domain": 591,
            "URL": 3931,
            "FileHash-SHA256": 431,
            "FileHash-MD5": 92,
            "FileHash-SHA1": 89
          },
          "indicator_count": 6438,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 93,
          "modified_text": "1079 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62419fedc849255cf3903185",
          "name": "http://caution.pro.mobile82.com/gb.j",
          "description": "A collection of breached small business routers and networks hosting a bunch of bad actor clean and not clean sites and storage facilities. Concerning that one of these small biz's is a UK criminal solictors with many creds for access to the UK cps and some courts",
          "modified": "2022-04-27T00:03:12.448000",
          "created": "2022-03-28T11:45:49.899000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "threat level",
            "pcap",
            "pcap processing",
            "date",
            "sha256",
            "windows nt",
            "data",
            "decrypted ssl",
            "size",
            "accept",
            "hybrid",
            "close",
            "click",
            "hosts",
            "mozilla",
            "format",
            "malicious",
            "general",
            "local",
            "service",
            "window",
            "mozi",
            "trident",
            "strings",
            "suspicious"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/5d5e18e86b4ac952e8e585b0f1c2bf3ad0785e152455c07cc8993a68908daad0/6228d8a4b08be7216462d17b"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 474,
            "URL": 2602,
            "domain": 224,
            "FileHash-SHA256": 331,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 40,
            "email": 2
          },
          "indicator_count": 3716,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 395,
          "modified_text": "1453 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62419ff515f8652c276a5fa5",
          "name": "http://caution.pro.mobile82.com/gb.j",
          "description": "A collection of breached small business routers and networks hosting a bunch of bad actor clean and not clean sites and storage facilities. Concerning that one of these small biz's is a UK criminal solictors with many creds for access to the UK cps and some courts",
          "modified": "2022-04-27T00:03:12.448000",
          "created": "2022-03-28T11:45:56.975000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "threat level",
            "pcap",
            "pcap processing",
            "date",
            "sha256",
            "windows nt",
            "data",
            "decrypted ssl",
            "size",
            "accept",
            "hybrid",
            "close",
            "click",
            "hosts",
            "mozilla",
            "format",
            "malicious",
            "general",
            "local",
            "service",
            "window",
            "mozi",
            "trident",
            "strings",
            "suspicious"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/5d5e18e86b4ac952e8e585b0f1c2bf3ad0785e152455c07cc8993a68908daad0/6228d8a4b08be7216462d17b"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 474,
            "URL": 2602,
            "domain": 224,
            "FileHash-SHA256": 331,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 40,
            "email": 2
          },
          "indicator_count": 3716,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 395,
          "modified_text": "1453 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62218e2d1f11bde0e7e3221e",
          "name": "Clarityelections.com",
          "description": "",
          "modified": "2022-04-02T00:04:50.405000",
          "created": "2022-03-04T03:57:33.434000",
          "tags": [
            "united",
            "aaaa",
            "nxdomain",
            "cname",
            "dns show",
            "search",
            "status hostname",
            "query type",
            "address first",
            "seen last"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6827,
            "hostname": 2735,
            "domain": 1384,
            "FileHash-SHA256": 346,
            "email": 1
          },
          "indicator_count": 11293,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1478 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "If someone has Medicare it\u2019s wise to check with carrier & providers to see policies generated by AI",
        "https://hybrid-analysis.com/sample/5d5e18e86b4ac952e8e585b0f1c2bf3ad0785e152455c07cc8993a68908daad0/6228d8a4b08be7216462d17b",
        "State (or random \u2022_- hackers) erased evidence of targets insurance all paid for by target.",
        "Researched: https://hcpf.colorado.gov/",
        "Provided documented evidence of appealed state issued plan and disclosed financials.",
        "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0",
        "https://securityaffairs.com/181338/security/google-fixed-chrome-flaw-found-by-big-sleep-ai.html",
        "https://passwords.google/?utm_medium=hpp&utm",
        "https://securityaffairs.com/109671/hacking/50000-home-cameras-hacked.html",
        "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
        "System has placed affected on multiple policies cancelling private policy without notice.",
        "I hope this goes smoothly. I believe will be a nightmare as witnessed. I hope I\u2019m wrong.",
        "Target also owned an online brokerage & lead company, was agent & insurance marketer for years.",
        "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
        "https://passwords.google/?utm_medium=hpp&utm_source=google&utm_campaign=sid2023aunonenms",
        "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
        "www.onyx-ware.com \u2022 https://www.endgamesystems.com/",
        "Paid for plan long after entity put target on a state plan. Target audited for making too much money (framed)",
        "September began with false information, defaulted claims , denials from authorized  services rendered years prior.",
        "Researched publicly available information provided by representative of a target\u2019s estate",
        "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
        "millet-usgc-1.palantirfedstart.com",
        "Won appeal. Denied stimulus until passing another audit showing taxable income and filed taxes"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Cobalt strike",
            "Domino",
            "Lizar",
            "Carbanak",
            "Project nemesis"
          ],
          "industries": [
            "Healthcare",
            "Financial",
            "Hospitality"
          ],
          "unique_indicators": 30055
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/minely.com",
    "whois": "http://whois.domaintools.com/minely.com",
    "domain": "minely.com",
    "hostname": "director.cloud.minely.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "68bbdb22e3d606ae8fb5cda8",
      "name": "HCPF | Department of Health Care Policy and Financing",
      "description": "Project Nemesis - Affects Department of Health Care Policy and Financing | Family representative  repeatedly told past bills aren\u2019t being paid by United Healthcare. Argus Insurance (unknown entity) was Policy on record target never had. FR was given information regarding HCPF which was being viewed by past vendor seen in (https://otx.alienvault.com/pulse/68bbb31f6d91989d7fcd9592) |  Issues with HCPF have been an issue for some time in isolated scenarios. It\u2019s unclear how at least one person keeps getting their name, bills and life pulled into this. Target PURCHASED a Healthcare policy via agent before major social engineering attacks. Same entity literally robs targets. Gift cards, phone services, cloud storage, account, insurance policies, bank account access, tax refunds, paid claims reversed & taken from target\u2019s account.\nMore research needed. Flaws  in new system could jeopardize many. \n#trulymissed #rip #techbrohell #palantir",
      "modified": "2025-10-06T05:01:18.794000",
      "created": "2025-09-06T06:56:34.649000",
      "tags": [
        "federal changes",
        "health first",
        "colorado",
        "child health",
        "plan plus",
        "newimpact",
        "medicaidour",
        "impact",
        "medicaid page",
        "medicaid",
        "beware",
        "text/html",
        "trackers",
        "iframes",
        "external-resources",
        "new relic",
        "g1gv3h3sxc0",
        "utc gcw970gh4gg",
        "android",
        "known exploited",
        "google",
        "salesloft drift",
        "sap s4hana",
        "cve202542957",
        "cisa",
        "sitecore",
        "linux",
        "france",
        "meta",
        "rokrat",
        "lizar",
        "project nemesis",
        "carbanak",
        "cobalt strike",
        "domino",
        "no expiration",
        "url https",
        "type indicator",
        "role title",
        "related pulses",
        "hostname https",
        "m4e5930",
        "hostname",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "ascii text",
        "search",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "dock",
        "write",
        "capture",
        "persistence",
        "malware",
        "roboto",
        "present feb",
        "united",
        "a domains",
        "present dec",
        "passive dns",
        "moved",
        "script domains",
        "script urls",
        "urls",
        "title",
        "date",
        "resolved ips",
        "http traffic",
        "http get",
        "match info",
        "downloads",
        "info",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "protocol t1095",
        "endgame systems"
      ],
      "references": [
        "Researched: https://hcpf.colorado.gov/",
        "www.onyx-ware.com \u2022 https://www.endgamesystems.com/",
        "millet-usgc-1.palantirfedstart.com",
        "https://securityaffairs.com/109671/hacking/50000-home-cameras-hacked.html",
        "https://passwords.google/?utm_medium=hpp&utm_source=google&utm_campaign=sid2023aunonenms",
        "https://passwords.google/?utm_medium=hpp&utm",
        "https://securityaffairs.com/181338/security/google-fixed-chrome-flaw-found-by-big-sleep-ai.html",
        "Researched publicly available information provided by representative of a target\u2019s estate",
        "System has placed affected on multiple policies cancelling private policy without notice.",
        "Paid for plan long after entity put target on a state plan. Target audited for making too much money (framed)",
        "Provided documented evidence of appealed state issued plan and disclosed financials.",
        "Won appeal. Denied stimulus until passing another audit showing taxable income and filed taxes",
        "I hope this goes smoothly. I believe will be a nightmare as witnessed. I hope I\u2019m wrong.",
        "State (or random \u2022_- hackers) erased evidence of targets insurance all paid for by target.",
        "Target also owned an online brokerage & lead company, was agent & insurance marketer for years.",
        "September began with false information, defaulted claims , denials from authorized  services rendered years prior.",
        "If someone has Medicare it\u2019s wise to check with carrier & providers to see policies generated by AI"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lizar",
          "display_name": "Lizar",
          "target": null
        },
        {
          "id": "Project Nemesis",
          "display_name": "Project Nemesis",
          "target": null
        },
        {
          "id": "Carbanak",
          "display_name": "Carbanak",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Domino",
          "display_name": "Domino",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [
        "Hospitality",
        "Financial",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1395,
        "URL": 4304,
        "CVE": 1,
        "domain": 694,
        "FileHash-SHA256": 1790,
        "FileHash-MD5": 183,
        "FileHash-SHA1": 103,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 8475,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "195 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570803fe514ca975b6db5cb",
      "name": "Clarityelections.com",
      "description": "",
      "modified": "2023-12-06T14:07:59.920000",
      "created": "2023-12-06T14:07:59.920000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 346,
        "hostname": 2735,
        "URL": 6827,
        "domain": 1384,
        "email": 1
      },
      "indicator_count": 11293,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "642eac06b2963a871b0fdd45",
      "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection",
      "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m",
      "modified": "2023-05-06T10:00:48.707000",
      "created": "2023-04-06T11:24:54.313000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "dropped file",
        "runtime data",
        "chromeua",
        "span",
        "optout",
        "pcap processing",
        "pattern match",
        "script",
        "click",
        "date",
        "middle",
        "null",
        "april",
        "twitter",
        "body",
        "error",
        "jackson",
        "desktop",
        "service",
        "bill",
        "heat",
        "webview",
        "cruise",
        "blank",
        "meta",
        "night",
        "false",
        "contact",
        "suspicious",
        "facebook",
        "close",
        "cannon",
        "mayberry",
        "santana",
        "comment",
        "flex",
        "karma",
        "nightmare",
        "find",
        "spacer",
        "kitty",
        "mike",
        "local",
        "already",
        "soldier",
        "wallpaper",
        "story",
        "generic",
        "tiny",
        "trident",
        "android",
        "hybrid",
        "general",
        "hosts",
        "favorite",
        "homepage",
        "music",
        "code",
        "push",
        "strings",
        "malicious",
        "qakbot",
        "25px",
        "60px",
        "24px",
        "100px",
        "1439px",
        "segoe ui",
        "roboto",
        "path",
        "chat",
        "form",
        "embed",
        "unknown",
        "live",
        "network",
        "unicode",
        "feed",
        "5000",
        "next",
        "fullscreen",
        "iframe",
        "latv",
        "latino voices",
        "localappdata",
        "latino",
        "noscript",
        "pragma",
        "this",
        "hybrid analysis",
        "programfiles",
        "input",
        "wilstaging02",
        "potential ip"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb",
        "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd",
        "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36",
        "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9",
        "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1291,
        "email": 13,
        "domain": 591,
        "URL": 3931,
        "FileHash-SHA256": 431,
        "FileHash-MD5": 92,
        "FileHash-SHA1": 89
      },
      "indicator_count": 6438,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 93,
      "modified_text": "1079 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62419fedc849255cf3903185",
      "name": "http://caution.pro.mobile82.com/gb.j",
      "description": "A collection of breached small business routers and networks hosting a bunch of bad actor clean and not clean sites and storage facilities. Concerning that one of these small biz's is a UK criminal solictors with many creds for access to the UK cps and some courts",
      "modified": "2022-04-27T00:03:12.448000",
      "created": "2022-03-28T11:45:49.899000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "threat level",
        "pcap",
        "pcap processing",
        "date",
        "sha256",
        "windows nt",
        "data",
        "decrypted ssl",
        "size",
        "accept",
        "hybrid",
        "close",
        "click",
        "hosts",
        "mozilla",
        "format",
        "malicious",
        "general",
        "local",
        "service",
        "window",
        "mozi",
        "trident",
        "strings",
        "suspicious"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/5d5e18e86b4ac952e8e585b0f1c2bf3ad0785e152455c07cc8993a68908daad0/6228d8a4b08be7216462d17b"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 474,
        "URL": 2602,
        "domain": 224,
        "FileHash-SHA256": 331,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 40,
        "email": 2
      },
      "indicator_count": 3716,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 395,
      "modified_text": "1453 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62419ff515f8652c276a5fa5",
      "name": "http://caution.pro.mobile82.com/gb.j",
      "description": "A collection of breached small business routers and networks hosting a bunch of bad actor clean and not clean sites and storage facilities. Concerning that one of these small biz's is a UK criminal solictors with many creds for access to the UK cps and some courts",
      "modified": "2022-04-27T00:03:12.448000",
      "created": "2022-03-28T11:45:56.975000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "threat level",
        "pcap",
        "pcap processing",
        "date",
        "sha256",
        "windows nt",
        "data",
        "decrypted ssl",
        "size",
        "accept",
        "hybrid",
        "close",
        "click",
        "hosts",
        "mozilla",
        "format",
        "malicious",
        "general",
        "local",
        "service",
        "window",
        "mozi",
        "trident",
        "strings",
        "suspicious"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/5d5e18e86b4ac952e8e585b0f1c2bf3ad0785e152455c07cc8993a68908daad0/6228d8a4b08be7216462d17b"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 474,
        "URL": 2602,
        "domain": 224,
        "FileHash-SHA256": 331,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 40,
        "email": 2
      },
      "indicator_count": 3716,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 395,
      "modified_text": "1453 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62218e2d1f11bde0e7e3221e",
      "name": "Clarityelections.com",
      "description": "",
      "modified": "2022-04-02T00:04:50.405000",
      "created": "2022-03-04T03:57:33.434000",
      "tags": [
        "united",
        "aaaa",
        "nxdomain",
        "cname",
        "dns show",
        "search",
        "status hostname",
        "query type",
        "address first",
        "seen last"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6827,
        "hostname": 2735,
        "domain": 1384,
        "FileHash-SHA256": 346,
        "email": 1
      },
      "indicator_count": 11293,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 406,
      "modified_text": "1478 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://director.cloud.minely.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://director.cloud.minely.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630151.7369907
}