{ "type": "URL", "indicator": "https://docs.api.clickguard.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://docs.api.clickguard.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4169847211, "indicator": "https://docs.api.clickguard.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "69560fa62bddc3d965359168", "name": "Mirai H5DATACENTERS.COM \u2022 Regis University Blackout | Extranet", "description": "It was Data Center 5. \nH5DATACENTERS.COM \u2022 Regis University Blackout PrometheusIntelligenceTechnology.com - Extranet. Forced out of RU for finding malicious link that targeted , tracked ,conversations , behavior, etc., \u201cNo one willingly signed up to be tracked.\u201dis what Tsara told Dean Archer. He said he\u2019d never seen anything like this in his life. RU ignored the risks Tsara cautioned could irreparably damage incoming students college experience and negatively impact their future. I just hope the many students who attended do not continue to suffer. Guess who the villain was? The truth teller. \n\nToday activity has stepped up. Somehow the PIT Pulse has caused a crusade of aggressive following and investigation. \n\nThere may be 10,000 vs 1 in this battle. But the One is God.", "modified": "2026-01-31T03:04:09.490000", "created": "2026-01-01T06:09:42.057000", "tags": [ "http", "files related", "related tags", "ipv4", "ccus asnas20029", "urls", "domain", "files ip", "address domain", "ip whois", "passive dns", "gmt path", "hostname add", "files", "united", "a li", "trackingpin a", "ip address", "unknown aaaa", "error", "back", "darkness", "present sep", "a domains", "script urls", "unknown ns", "script domains", "meta", "apache", "body doctype", "gmt server", "url analysis", "path", "accept", "pragma", "west domains", "present dec", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "data upload", "extraction", "found", "datacenter", "hosting", "vps reverse", "america united", "america asn", "as398101", "body html", "head title", "title", "status", "name servers", "failed", "all se", "enter sc", "type", "extra data", "referen", "manualv add", "indicator data", "port", "destination", "south korea", "china as4134", "taiwan as3462", "as3786 lg", "as4766 korea", "as9318 sk", "high", "tcp syn", "trojan", "pegasus", "malware", "unknown", "search", "present jan", "pur sta", "uni idc", "cao oti", "dsp cor", "body", "win32", "united states", "pulse tags", "palantir", "ad maven", "technology", "url https", "url http", "indicator role", "title added", "active related", "Palantir", "Ad-Maven", "Palantir", "Ad- Maven", "Prometheus Intelligence Technology", "skynet", "starfield tech", "flock", "report spam", "palantir ad", "maven", "botnet", "created", "days ago", "education", "tsara", "mirai", "regis", "brashears", "discovery", "universities", "tsara brashears", "close", "stop", "ransom", "capture", "denver" ], "references": [ "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM", "https://prometheusintelligencetechnology.com/pit/", "https://prometheusintelligencetechnology.com/404javascript.js", "https://www.secureserver.net/default404.aspx", "http://ocsp.starfieldtech.com/ 443 Certificate", "https://www.secureserver.net/default404.aspx Server: Microsoft-IIS/7.0", "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/ P3P:", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "Powered-By: ARR/2.5 X-Powered-By: ASP.NET", "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found Content-Length: 161", "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )", "Certificate Crldistributionpoints", "http://crl.starfieldtech.com/sfig2s2-0.crl 443", "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net", "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers", "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443", "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443", "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443", "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer", "http://certs.starfieldtech.com/repository/ 443", "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443", "A Domains \u2022 www.secureserver.net 443 Certificate", "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx", "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found Cache-Control: private", "Content-Length: 160 Location: http://www.secureserver.net/default404.aspx", "Server: Microsoft-IIS/7.0 Set-Cookie: market=en-US; domain=secureserver.net;", "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/ P3P: policyref=\"/w3c/p3p.xml\",", "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "X-Powered-By: ARR/2.5 X-Powered-By: ASP.NET P3P: policyref=\"/w3c/p3p.xml\", CP=\"", "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "Date: Tue, 13 Jun 2017 10:21:34 GMT", "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc", "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org", "PDNS11.DOMAINCONTROL.COM", "https://otx.alienvault.com/indicator/domain/secureserver.net", "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf", "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication", "https://den.h5datacenters.com/", "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer", "register.blackgirldroneworld.com (Is this racist)", "https://stetsed.xyz/apple", "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology", "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co", "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD", "Patient/ Victim unaware of her workers compensation rights.", "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!", "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey", "I haven\u2019t mentioned the hit men they hired.", "Fastly.com", "www.skynetsoftware.com", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android®=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox", "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Virus:Win32/Triusor.A", "display_name": "Virus:Win32/Triusor.A", "target": "/malware/Virus:Win32/Triusor.A" }, { "id": "!InstallCreatorPro_2_0", "display_name": "!InstallCreatorPro_2_0", "target": null }, { "id": "Unix.Trojan.Mirai-7640640-0", "display_name": "Unix.Trojan.Mirai-7640640-0", "target": null }, { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Win.Downloader", "display_name": "Win.Downloader", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2817, "domain": 487, "hostname": 983, "FileHash-SHA256": 611, "FileHash-MD5": 107, "FileHash-SHA1": 106, "email": 2 }, "indicator_count": 5113, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "78 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695043197c2fbfda85abc1d4", "name": "Palantir Ad Maven tracking under various names | Espionage Malware &Botnet associated", "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just", "modified": "2025-12-27T20:35:37.012000", "created": "2025-12-27T20:35:37.012000", "tags": [ "Palantir", "Ad- Maven", "Prometheus Intelligence Technology" ], "references": [ "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel", "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Carts.Guru", "display_name": "Carts.Guru", "target": null } ], "attack_ids": [], "industries": [ "Government", "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 82, "hostname": 180, "URL": 995, "FileHash-SHA256": 110 }, "indicator_count": 1367, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "112 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/ P3P:", "http://ocsp.starfieldtech.com/ 443 Certificate", "Patient/ Victim unaware of her workers compensation rights.", "I haven\u2019t mentioned the hit men they hired.", "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org", "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers", "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443", "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey", "https://otx.alienvault.com/indicator/domain/secureserver.net", "Content-Length: 160 Location: http://www.secureserver.net/default404.aspx", "register.blackgirldroneworld.com (Is this racist)", "Certificate Crldistributionpoints", "Powered-By: ARR/2.5 X-Powered-By: ASP.NET", "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx", "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t", "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "Fastly.com", "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443", "https://stetsed.xyz/apple", "A Domains \u2022 www.secureserver.net 443 Certificate", "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/ P3P: policyref=\"/w3c/p3p.xml\",", "www.skynetsoftware.com", "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf", "http://crl.starfieldtech.com/sfig2s2-0.crl 443", "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android®=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t", "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM", "Server: Microsoft-IIS/7.0 Set-Cookie: market=en-US; domain=secureserver.net;", "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )", "X-Powered-By: ARR/2.5 X-Powered-By: ASP.NET P3P: policyref=\"/w3c/p3p.xml\", CP=\"", "https://prometheusintelligencetechnology.com/pit/", "https://www.secureserver.net/default404.aspx", "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found Content-Length: 161", "https://www.secureserver.net/default404.aspx Server: Microsoft-IIS/7.0", "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443", "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse", "http://certs.starfieldtech.com/repository/ 443", "https://den.h5datacenters.com/", "https://prometheusintelligencetechnology.com/404javascript.js", "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net", "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox", "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication", "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology", "PDNS11.DOMAINCONTROL.COM", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer", "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml", "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co", "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!", "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found Cache-Control: private", "Date: Tue, 13 Jun 2017 10:21:34 GMT", "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD", "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Virus:win32/triusor.a", "!installcreatorpro_2_0", "Win.downloader", "#lowfienabledtcontinueafterunpacking", "Mirai", "Unix.trojan.mirai-7640640-0", "Carts.guru" ], "industries": [ "Government", "Education", "Civil society" ], "unique_indicators": 5355 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/clickguard.com", "whois": "http://whois.domaintools.com/clickguard.com", "domain": "clickguard.com", "hostname": "docs.api.clickguard.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "69560fa62bddc3d965359168", "name": "Mirai H5DATACENTERS.COM \u2022 Regis University Blackout | Extranet", "description": "It was Data Center 5. \nH5DATACENTERS.COM \u2022 Regis University Blackout PrometheusIntelligenceTechnology.com - Extranet. Forced out of RU for finding malicious link that targeted , tracked ,conversations , behavior, etc., \u201cNo one willingly signed up to be tracked.\u201dis what Tsara told Dean Archer. He said he\u2019d never seen anything like this in his life. RU ignored the risks Tsara cautioned could irreparably damage incoming students college experience and negatively impact their future. I just hope the many students who attended do not continue to suffer. Guess who the villain was? The truth teller. \n\nToday activity has stepped up. Somehow the PIT Pulse has caused a crusade of aggressive following and investigation. \n\nThere may be 10,000 vs 1 in this battle. But the One is God.", "modified": "2026-01-31T03:04:09.490000", "created": "2026-01-01T06:09:42.057000", "tags": [ "http", "files related", "related tags", "ipv4", "ccus asnas20029", "urls", "domain", "files ip", "address domain", "ip whois", "passive dns", "gmt path", "hostname add", "files", "united", "a li", "trackingpin a", "ip address", "unknown aaaa", "error", "back", "darkness", "present sep", "a domains", "script urls", "unknown ns", "script domains", "meta", "apache", "body doctype", "gmt server", "url analysis", "path", "accept", "pragma", "west domains", "present dec", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "data upload", "extraction", "found", "datacenter", "hosting", "vps reverse", "america united", "america asn", "as398101", "body html", "head title", "title", "status", "name servers", "failed", "all se", "enter sc", "type", "extra data", "referen", "manualv add", "indicator data", "port", "destination", "south korea", "china as4134", "taiwan as3462", "as3786 lg", "as4766 korea", "as9318 sk", "high", "tcp syn", "trojan", "pegasus", "malware", "unknown", "search", "present jan", "pur sta", "uni idc", "cao oti", "dsp cor", "body", "win32", "united states", "pulse tags", "palantir", "ad maven", "technology", "url https", "url http", "indicator role", "title added", "active related", "Palantir", "Ad-Maven", "Palantir", "Ad- Maven", "Prometheus Intelligence Technology", "skynet", "starfield tech", "flock", "report spam", "palantir ad", "maven", "botnet", "created", "days ago", "education", "tsara", "mirai", "regis", "brashears", "discovery", "universities", "tsara brashears", "close", "stop", "ransom", "capture", "denver" ], "references": [ "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM", "https://prometheusintelligencetechnology.com/pit/", "https://prometheusintelligencetechnology.com/404javascript.js", "https://www.secureserver.net/default404.aspx", "http://ocsp.starfieldtech.com/ 443 Certificate", "https://www.secureserver.net/default404.aspx Server: Microsoft-IIS/7.0", "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/ P3P:", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "Powered-By: ARR/2.5 X-Powered-By: ASP.NET", "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found Content-Length: 161", "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )", "Certificate Crldistributionpoints", "http://crl.starfieldtech.com/sfig2s2-0.crl 443", "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net", "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers", "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443", "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443", "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443", "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer", "http://certs.starfieldtech.com/repository/ 443", "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443", "A Domains \u2022 www.secureserver.net 443 Certificate", "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx", "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found Cache-Control: private", "Content-Length: 160 Location: http://www.secureserver.net/default404.aspx", "Server: Microsoft-IIS/7.0 Set-Cookie: market=en-US; domain=secureserver.net;", "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/ P3P: policyref=\"/w3c/p3p.xml\",", "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "X-Powered-By: ARR/2.5 X-Powered-By: ASP.NET P3P: policyref=\"/w3c/p3p.xml\", CP=\"", "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "Date: Tue, 13 Jun 2017 10:21:34 GMT", "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc", "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org", "PDNS11.DOMAINCONTROL.COM", "https://otx.alienvault.com/indicator/domain/secureserver.net", "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf", "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication", "https://den.h5datacenters.com/", "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer", "register.blackgirldroneworld.com (Is this racist)", "https://stetsed.xyz/apple", "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology", "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co", "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD", "Patient/ Victim unaware of her workers compensation rights.", "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!", "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey", "I haven\u2019t mentioned the hit men they hired.", "Fastly.com", "www.skynetsoftware.com", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android®=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox", "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Virus:Win32/Triusor.A", "display_name": "Virus:Win32/Triusor.A", "target": "/malware/Virus:Win32/Triusor.A" }, { "id": "!InstallCreatorPro_2_0", "display_name": "!InstallCreatorPro_2_0", "target": null }, { "id": "Unix.Trojan.Mirai-7640640-0", "display_name": "Unix.Trojan.Mirai-7640640-0", "target": null }, { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Win.Downloader", "display_name": "Win.Downloader", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2817, "domain": 487, "hostname": 983, "FileHash-SHA256": 611, "FileHash-MD5": 107, "FileHash-SHA1": 106, "email": 2 }, "indicator_count": 5113, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "78 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695043197c2fbfda85abc1d4", "name": "Palantir Ad Maven tracking under various names | Espionage Malware &Botnet associated", "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just", "modified": "2025-12-27T20:35:37.012000", "created": "2025-12-27T20:35:37.012000", "tags": [ "Palantir", "Ad- Maven", "Prometheus Intelligence Technology" ], "references": [ "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel", "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Carts.Guru", "display_name": "Carts.Guru", "target": null } ], "attack_ids": [], "industries": [ "Government", "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 82, "hostname": 180, "URL": 995, "FileHash-SHA256": 110 }, "indicator_count": 1367, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "112 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://docs.api.clickguard.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://docs.api.clickguard.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776629366.1857772 }