{
  "type": "URL",
  "indicator": "https://dweeseny.com/tabs/lense",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://dweeseny.com/tabs/lense",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4137882443,
      "indicator": "https://dweeseny.com/tabs/lense",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6a16a621eac2621d97ca6596",
          "name": "Credit Q.Vashti [\"Device Isolation | Lumen Technologies | Palantir and\"] clone by Q Vashti (researcher)",
          "description": "",
          "modified": "2026-05-27T08:25:07.936000",
          "created": "2026-05-27T08:06:57.005000",
          "tags": [
            "url https",
            "url http",
            "tlsv1",
            "whitelisted",
            "united",
            "read c",
            "as15169",
            "stcalifornia",
            "execution",
            "dock",
            "write",
            "persistence",
            "malware",
            "encrypt",
            "active",
            "lumen technologies",
            "number",
            "error",
            "regexp",
            "sxa0",
            "amptoken",
            "optout",
            "retrieving",
            "notfound",
            "unknown",
            "form",
            "flash",
            "backdoor",
            "writeconsolew",
            "yara detections",
            "command line",
            "pdb path",
            "pe resource",
            "internalname",
            "windows command",
            "A",
            "aws",
            "name servers",
            "url analysis",
            "passive dns",
            "urls",
            "data upload",
            "extraction",
            "palantir",
            "c2",
            "aerospace",
            "tracking",
            "spywatchdog",
            "palapa-c2",
            "communications satellite",
            "amazon",
            "hughesnet",
            "icmp traffic",
            "washington c",
            "washington ou",
            "mopr",
            "mon jul",
            "local",
            "dynamic",
            "apple",
            "network",
            "t1057",
            "discovery",
            "t1069",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480",
            "guardrails",
            "t1566",
            "present jan",
            "unknown ns",
            "ip address",
            "dnssec",
            "domain",
            "dynamic dns",
            "government",
            "pcup",
            "germany unknown",
            "link",
            "dns hosting",
            "cloudns",
            "cloud dns",
            "a domains",
            "ipv4 add",
            "title",
            "meta",
            "class",
            "servers",
            "present aug",
            "aaaa",
            "present sep",
            "present nov",
            "present jul",
            "present may",
            "moved",
            "canada unknown",
            "begin",
            "record value",
            "gmt content",
            "type",
            "hostname add",
            "files",
            "ascii text",
            "pattern match",
            "href",
            "mitre att",
            "ck id",
            "ck matrix",
            "network traffic",
            "et info",
            "general",
            "path",
            "click",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "input url",
            "defense evasion",
            "france",
            "ireland",
            "netherlands",
            "denmark",
            "united kingdom",
            "type indicator",
            "role title",
            "added active",
            "savvis",
            "centurylinktechnology",
            "hybrid analysis",
            "monitoring tools",
            "monitored target",
            "triangulation",
            "worm",
            "intel",
            "ms windows",
            "pe32",
            "write c",
            "delete c",
            "show",
            "russia as47764",
            "unix",
            "lsan jose",
            "odigicert inc",
            "markus",
            "url add",
            "http",
            "related nids",
            "files location",
            "russia flag",
            "russia hostname",
            "russia",
            "russia unknown",
            "hosting",
            "federation flag",
            "body",
            "gmt vary",
            "accept encoding",
            "gmt cache",
            "certificate",
            "pulse submit",
            "unknown aaaa",
            "search",
            "entries",
            "script domains",
            "script urls",
            "pdx cf"
          ],
          "references": [
            "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
            "Yare: compromised_site_redirector_fromcharcode",
            "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
            "Alerts: console_output has_pdb pe_unknown_resource_name",
            "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
            "Tipped: A targets AI and other cyber research findings.",
            "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
            "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
            "https://palapa.c.id\t (c.id)",
            "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
            "cedevice.io  \u2022 decagonsoftware.com",
            "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
            "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
            "pcup.gov.ph:",
            "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
            "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
            "https://elegantcosmedampyeah.pages.dev/",
            "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
            "inst.govelopscold.com",
            "https://feedback.ptv.vic.gov.au/360",
            "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
            "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
            "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d",
            "https://brand.centurylinktechnology.com",
            "https://prod.centurylinktechnology.com",
            "https://brand2.centurylinktechnology.com",
            "https://mobile-pocket-guide.centurylinktechnology.com",
            "UPX_OEP_place",
            "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
            "ASP. NET",
            "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
            "7box.vip"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan.Tofsee/Botx",
              "display_name": "Trojan.Tofsee/Botx",
              "target": null
            },
            {
              "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "target": null
            },
            {
              "id": "PWS:Win32/Axespec.A",
              "display_name": "PWS:Win32/Axespec.A",
              "target": "/malware/PWS:Win32/Axespec.A"
            },
            {
              "id": "Worm:Win32/Lightmoon.H",
              "display_name": "Worm:Win32/Lightmoon.H",
              "target": "/malware/Worm:Win32/Lightmoon.H"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1439",
              "name": "Eavesdrop on Insecure Network Communication",
              "display_name": "T1439 - Eavesdrop on Insecure Network Communication"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1069.003",
              "name": "Cloud Groups",
              "display_name": "T1069.003 - Cloud Groups"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "697cdce9ec418c422eee2054",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 102,
            "FileHash-SHA1": 59,
            "FileHash-SHA256": 1929,
            "domain": 854,
            "hostname": 2156,
            "URL": 4475,
            "SSLCertFingerprint": 9,
            "email": 8,
            "CVE": 2
          },
          "indicator_count": 9594,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "697cdce9ec418c422eee2054",
          "name": "Device Isolation: Lumen Technologies | Palantir and \u2018Boots on the Ground Operations\u2019",
          "description": "Device Isolation: Lumen Technologies (formerly CenturyLink) deployed as an admin on iOS devices. Standard factory resets may prove ineffective. Complete hardware \"air-gap\" or clean devices that have never touched your home network may be best option for deeply monitored targets.\n\nSummary of the Campaign:\nThe involvement of Lumen Technologies (as an unwanted admin), Foundry (Palantir) for data mapping, and Mirai Botnet for network disruption represents a \"scorched earth\" approach to digital destruction. Target treated  as a criminal through Cellebrite, implicates specific attackers attempted to legalize what was actually a predatory stalking campaign/s.\n\n\nSurveillance Overlap: The use of  Lumen Technologies and Palantir, tools allows for real-time tracking of a target's physical location\u2014explains how \u2018boots on the ground\u2019 offenders can stalk , surveillance , confront, assault  and engage in various damaging attacks of specific monitored targets.",
          "modified": "2026-03-01T16:05:57.375000",
          "created": "2026-01-30T16:31:37.011000",
          "tags": [
            "url https",
            "url http",
            "tlsv1",
            "whitelisted",
            "united",
            "read c",
            "as15169",
            "stcalifornia",
            "execution",
            "dock",
            "write",
            "persistence",
            "malware",
            "encrypt",
            "active",
            "lumen technologies",
            "number",
            "error",
            "regexp",
            "sxa0",
            "amptoken",
            "optout",
            "retrieving",
            "notfound",
            "unknown",
            "form",
            "flash",
            "backdoor",
            "writeconsolew",
            "yara detections",
            "command line",
            "pdb path",
            "pe resource",
            "internalname",
            "windows command",
            "A",
            "aws",
            "name servers",
            "url analysis",
            "passive dns",
            "urls",
            "data upload",
            "extraction",
            "palantir",
            "c2",
            "aerospace",
            "tracking",
            "spywatchdog",
            "palapa-c2",
            "communications satellite",
            "amazon",
            "hughesnet",
            "icmp traffic",
            "washington c",
            "washington ou",
            "mopr",
            "mon jul",
            "local",
            "dynamic",
            "apple",
            "network",
            "t1057",
            "discovery",
            "t1069",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480",
            "guardrails",
            "t1566",
            "present jan",
            "unknown ns",
            "ip address",
            "dnssec",
            "domain",
            "dynamic dns",
            "government",
            "pcup",
            "germany unknown",
            "link",
            "dns hosting",
            "cloudns",
            "cloud dns",
            "a domains",
            "ipv4 add",
            "title",
            "meta",
            "class",
            "servers",
            "present aug",
            "aaaa",
            "present sep",
            "present nov",
            "present jul",
            "present may",
            "moved",
            "canada unknown",
            "begin",
            "record value",
            "gmt content",
            "type",
            "hostname add",
            "files",
            "ascii text",
            "pattern match",
            "href",
            "mitre att",
            "ck id",
            "ck matrix",
            "network traffic",
            "et info",
            "general",
            "path",
            "click",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "input url",
            "defense evasion",
            "france",
            "ireland",
            "netherlands",
            "denmark",
            "united kingdom",
            "type indicator",
            "role title",
            "added active",
            "savvis",
            "centurylinktechnology",
            "hybrid analysis",
            "monitoring tools",
            "monitored target",
            "triangulation",
            "worm",
            "intel",
            "ms windows",
            "pe32",
            "write c",
            "delete c",
            "show",
            "russia as47764",
            "unix",
            "lsan jose",
            "odigicert inc",
            "markus",
            "url add",
            "http",
            "related nids",
            "files location",
            "russia flag",
            "russia hostname",
            "russia",
            "russia unknown",
            "hosting",
            "federation flag",
            "body",
            "gmt vary",
            "accept encoding",
            "gmt cache",
            "certificate",
            "pulse submit",
            "unknown aaaa",
            "search",
            "entries",
            "script domains",
            "script urls",
            "pdx cf"
          ],
          "references": [
            "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
            "Yare: compromised_site_redirector_fromcharcode",
            "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
            "Alerts: console_output has_pdb pe_unknown_resource_name",
            "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
            "Tipped: A targets AI and other cyber research findings.",
            "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
            "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
            "https://palapa.c.id\t (c.id)",
            "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
            "cedevice.io  \u2022 decagonsoftware.com",
            "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
            "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
            "pcup.gov.ph:",
            "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
            "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
            "https://elegantcosmedampyeah.pages.dev/",
            "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
            "inst.govelopscold.com",
            "https://feedback.ptv.vic.gov.au/360",
            "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
            "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
            "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d",
            "https://brand.centurylinktechnology.com",
            "https://prod.centurylinktechnology.com",
            "https://brand2.centurylinktechnology.com",
            "https://mobile-pocket-guide.centurylinktechnology.com",
            "UPX_OEP_place",
            "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
            "ASP. NET",
            "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
            "7box.vip"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan.Tofsee/Botx",
              "display_name": "Trojan.Tofsee/Botx",
              "target": null
            },
            {
              "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "target": null
            },
            {
              "id": "PWS:Win32/Axespec.A",
              "display_name": "PWS:Win32/Axespec.A",
              "target": "/malware/PWS:Win32/Axespec.A"
            },
            {
              "id": "Worm:Win32/Lightmoon.H",
              "display_name": "Worm:Win32/Lightmoon.H",
              "target": "/malware/Worm:Win32/Lightmoon.H"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1439",
              "name": "Eavesdrop on Insecure Network Communication",
              "display_name": "T1439 - Eavesdrop on Insecure Network Communication"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1069.003",
              "name": "Cloud Groups",
              "display_name": "T1069.003 - Cloud Groups"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 102,
            "FileHash-SHA1": 59,
            "FileHash-SHA256": 1929,
            "domain": 854,
            "hostname": 2156,
            "URL": 4475,
            "SSLCertFingerprint": 9,
            "email": 7,
            "CVE": 1
          },
          "indicator_count": 9592,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68e2bb5d9ee8577ab5519f2c",
          "name": "Meritshealth with DoD links? ",
          "description": "",
          "modified": "2026-01-13T00:05:56.401000",
          "created": "2025-10-05T18:39:25.286000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "68e2b14d83bb63502feac65e",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1365,
            "URL": 11172,
            "hostname": 2780,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4420,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 20486,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "138 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68e2b14d83bb63502feac65e",
          "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
          "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
          "modified": "2026-01-07T00:00:30.717000",
          "created": "2025-10-05T17:56:29.109000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1328,
            "URL": 9931,
            "hostname": 2621,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4360,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 18989,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "144 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68e2b9fd811ffc6684ba25f7",
          "name": "Isolated DoD now DoW nodes - emotional commentary",
          "description": "*https://www.sentient.industries/\n*trk.b.jackrogersusa.com\n*http://trk.southerntide.com/\nOTX is auto populating this pulse. Let\u2019s see\u2026",
          "modified": "2025-11-04T18:01:18.650000",
          "created": "2025-10-05T18:33:33.277000",
          "tags": [
            "united",
            "present feb",
            "present may",
            "aaaa",
            "present jul",
            "passive dns",
            "ip address",
            "present dec",
            "present sep",
            "present jun",
            "url https",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "germany",
            "taiwan",
            "netherlands",
            "china",
            "search",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "ascii text",
            "size",
            "pattern match",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "body",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "title",
            "look",
            "verify",
            "restart",
            "filehashmd5",
            "hostname",
            "filehashsha256",
            "types of",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "ruby",
            "jeffrey reimer",
            "target",
            "tsara",
            "information",
            "capture",
            "gather victim",
            "report spam",
            "kill targets",
            "created",
            "starfield",
            "show technique",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1333,
            "domain": 355,
            "URL": 5874,
            "hostname": 1066,
            "FileHash-SHA1": 101,
            "FileHash-MD5": 88,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 8819,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "207 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://prod.centurylinktechnology.com",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://es.pornhat.com/models/the-sex-creator/",
        "There is fear in silence or speaking out",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "https://brand2.centurylinktechnology.com",
        "cedevice.io  \u2022 decagonsoftware.com",
        "https://feedback.ptv.vic.gov.au/360",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
        "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "I am very upset. Whoever is doing this is sick.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "If someone is believed to be a threat they have right to due process.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "iamrobert.com Y.A.S.",
        "https://elegantcosmedampyeah.pages.dev/",
        "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
        "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://palapa.c.id\t (c.id)",
        "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "Can the DoD no questions asked target a SA victim",
        "Target agreed and complied with all lie detector measures.",
        "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
        "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d",
        "Tipped: A targets AI and other cyber research findings.",
        "https://mobile-pocket-guide.centurylinktechnology.com",
        "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
        "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "Yare: compromised_site_redirector_fromcharcode",
        "ASP. NET",
        "7box.vip",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "pcup.gov.ph:",
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
        "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
        "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "inst.govelopscold.com",
        "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "UPX_OEP_place",
        "Alerts: console_output has_pdb pe_unknown_resource_name",
        "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
        "https://meumundogay-com.sexogratis.page/locker",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://brand.centurylinktechnology.com",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Pws:win32/axespec.a",
            "Trojan.tofsee/botx",
            "Malware",
            "Apnic",
            "Worm:win32/lightmoon.h",
            "Alf:jasyp:trojan:win32/ircbot!atmn"
          ],
          "industries": [],
          "unique_indicators": 32724
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/dweeseny.com",
    "whois": "http://whois.domaintools.com/dweeseny.com",
    "domain": "dweeseny.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6a16a621eac2621d97ca6596",
      "name": "Credit Q.Vashti [\"Device Isolation | Lumen Technologies | Palantir and\"] clone by Q Vashti (researcher)",
      "description": "",
      "modified": "2026-05-27T08:25:07.936000",
      "created": "2026-05-27T08:06:57.005000",
      "tags": [
        "url https",
        "url http",
        "tlsv1",
        "whitelisted",
        "united",
        "read c",
        "as15169",
        "stcalifornia",
        "execution",
        "dock",
        "write",
        "persistence",
        "malware",
        "encrypt",
        "active",
        "lumen technologies",
        "number",
        "error",
        "regexp",
        "sxa0",
        "amptoken",
        "optout",
        "retrieving",
        "notfound",
        "unknown",
        "form",
        "flash",
        "backdoor",
        "writeconsolew",
        "yara detections",
        "command line",
        "pdb path",
        "pe resource",
        "internalname",
        "windows command",
        "A",
        "aws",
        "name servers",
        "url analysis",
        "passive dns",
        "urls",
        "data upload",
        "extraction",
        "palantir",
        "c2",
        "aerospace",
        "tracking",
        "spywatchdog",
        "palapa-c2",
        "communications satellite",
        "amazon",
        "hughesnet",
        "icmp traffic",
        "washington c",
        "washington ou",
        "mopr",
        "mon jul",
        "local",
        "dynamic",
        "apple",
        "network",
        "t1057",
        "discovery",
        "t1069",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480",
        "guardrails",
        "t1566",
        "present jan",
        "unknown ns",
        "ip address",
        "dnssec",
        "domain",
        "dynamic dns",
        "government",
        "pcup",
        "germany unknown",
        "link",
        "dns hosting",
        "cloudns",
        "cloud dns",
        "a domains",
        "ipv4 add",
        "title",
        "meta",
        "class",
        "servers",
        "present aug",
        "aaaa",
        "present sep",
        "present nov",
        "present jul",
        "present may",
        "moved",
        "canada unknown",
        "begin",
        "record value",
        "gmt content",
        "type",
        "hostname add",
        "files",
        "ascii text",
        "pattern match",
        "href",
        "mitre att",
        "ck id",
        "ck matrix",
        "network traffic",
        "et info",
        "general",
        "path",
        "click",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "input url",
        "defense evasion",
        "france",
        "ireland",
        "netherlands",
        "denmark",
        "united kingdom",
        "type indicator",
        "role title",
        "added active",
        "savvis",
        "centurylinktechnology",
        "hybrid analysis",
        "monitoring tools",
        "monitored target",
        "triangulation",
        "worm",
        "intel",
        "ms windows",
        "pe32",
        "write c",
        "delete c",
        "show",
        "russia as47764",
        "unix",
        "lsan jose",
        "odigicert inc",
        "markus",
        "url add",
        "http",
        "related nids",
        "files location",
        "russia flag",
        "russia hostname",
        "russia",
        "russia unknown",
        "hosting",
        "federation flag",
        "body",
        "gmt vary",
        "accept encoding",
        "gmt cache",
        "certificate",
        "pulse submit",
        "unknown aaaa",
        "search",
        "entries",
        "script domains",
        "script urls",
        "pdx cf"
      ],
      "references": [
        "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
        "Yare: compromised_site_redirector_fromcharcode",
        "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
        "Alerts: console_output has_pdb pe_unknown_resource_name",
        "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
        "Tipped: A targets AI and other cyber research findings.",
        "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
        "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
        "https://palapa.c.id\t (c.id)",
        "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
        "cedevice.io  \u2022 decagonsoftware.com",
        "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
        "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
        "pcup.gov.ph:",
        "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
        "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
        "https://elegantcosmedampyeah.pages.dev/",
        "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
        "inst.govelopscold.com",
        "https://feedback.ptv.vic.gov.au/360",
        "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
        "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
        "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d",
        "https://brand.centurylinktechnology.com",
        "https://prod.centurylinktechnology.com",
        "https://brand2.centurylinktechnology.com",
        "https://mobile-pocket-guide.centurylinktechnology.com",
        "UPX_OEP_place",
        "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
        "ASP. NET",
        "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
        "7box.vip"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan.Tofsee/Botx",
          "display_name": "Trojan.Tofsee/Botx",
          "target": null
        },
        {
          "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "target": null
        },
        {
          "id": "PWS:Win32/Axespec.A",
          "display_name": "PWS:Win32/Axespec.A",
          "target": "/malware/PWS:Win32/Axespec.A"
        },
        {
          "id": "Worm:Win32/Lightmoon.H",
          "display_name": "Worm:Win32/Lightmoon.H",
          "target": "/malware/Worm:Win32/Lightmoon.H"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1439",
          "name": "Eavesdrop on Insecure Network Communication",
          "display_name": "T1439 - Eavesdrop on Insecure Network Communication"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1078.004",
          "name": "Cloud Accounts",
          "display_name": "T1078.004 - Cloud Accounts"
        },
        {
          "id": "T1069.003",
          "name": "Cloud Groups",
          "display_name": "T1069.003 - Cloud Groups"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "697cdce9ec418c422eee2054",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 102,
        "FileHash-SHA1": 59,
        "FileHash-SHA256": 1929,
        "domain": 854,
        "hostname": 2156,
        "URL": 4475,
        "SSLCertFingerprint": 9,
        "email": 8,
        "CVE": 2
      },
      "indicator_count": 9594,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "697cdce9ec418c422eee2054",
      "name": "Device Isolation: Lumen Technologies | Palantir and \u2018Boots on the Ground Operations\u2019",
      "description": "Device Isolation: Lumen Technologies (formerly CenturyLink) deployed as an admin on iOS devices. Standard factory resets may prove ineffective. Complete hardware \"air-gap\" or clean devices that have never touched your home network may be best option for deeply monitored targets.\n\nSummary of the Campaign:\nThe involvement of Lumen Technologies (as an unwanted admin), Foundry (Palantir) for data mapping, and Mirai Botnet for network disruption represents a \"scorched earth\" approach to digital destruction. Target treated  as a criminal through Cellebrite, implicates specific attackers attempted to legalize what was actually a predatory stalking campaign/s.\n\n\nSurveillance Overlap: The use of  Lumen Technologies and Palantir, tools allows for real-time tracking of a target's physical location\u2014explains how \u2018boots on the ground\u2019 offenders can stalk , surveillance , confront, assault  and engage in various damaging attacks of specific monitored targets.",
      "modified": "2026-03-01T16:05:57.375000",
      "created": "2026-01-30T16:31:37.011000",
      "tags": [
        "url https",
        "url http",
        "tlsv1",
        "whitelisted",
        "united",
        "read c",
        "as15169",
        "stcalifornia",
        "execution",
        "dock",
        "write",
        "persistence",
        "malware",
        "encrypt",
        "active",
        "lumen technologies",
        "number",
        "error",
        "regexp",
        "sxa0",
        "amptoken",
        "optout",
        "retrieving",
        "notfound",
        "unknown",
        "form",
        "flash",
        "backdoor",
        "writeconsolew",
        "yara detections",
        "command line",
        "pdb path",
        "pe resource",
        "internalname",
        "windows command",
        "A",
        "aws",
        "name servers",
        "url analysis",
        "passive dns",
        "urls",
        "data upload",
        "extraction",
        "palantir",
        "c2",
        "aerospace",
        "tracking",
        "spywatchdog",
        "palapa-c2",
        "communications satellite",
        "amazon",
        "hughesnet",
        "icmp traffic",
        "washington c",
        "washington ou",
        "mopr",
        "mon jul",
        "local",
        "dynamic",
        "apple",
        "network",
        "t1057",
        "discovery",
        "t1069",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480",
        "guardrails",
        "t1566",
        "present jan",
        "unknown ns",
        "ip address",
        "dnssec",
        "domain",
        "dynamic dns",
        "government",
        "pcup",
        "germany unknown",
        "link",
        "dns hosting",
        "cloudns",
        "cloud dns",
        "a domains",
        "ipv4 add",
        "title",
        "meta",
        "class",
        "servers",
        "present aug",
        "aaaa",
        "present sep",
        "present nov",
        "present jul",
        "present may",
        "moved",
        "canada unknown",
        "begin",
        "record value",
        "gmt content",
        "type",
        "hostname add",
        "files",
        "ascii text",
        "pattern match",
        "href",
        "mitre att",
        "ck id",
        "ck matrix",
        "network traffic",
        "et info",
        "general",
        "path",
        "click",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "input url",
        "defense evasion",
        "france",
        "ireland",
        "netherlands",
        "denmark",
        "united kingdom",
        "type indicator",
        "role title",
        "added active",
        "savvis",
        "centurylinktechnology",
        "hybrid analysis",
        "monitoring tools",
        "monitored target",
        "triangulation",
        "worm",
        "intel",
        "ms windows",
        "pe32",
        "write c",
        "delete c",
        "show",
        "russia as47764",
        "unix",
        "lsan jose",
        "odigicert inc",
        "markus",
        "url add",
        "http",
        "related nids",
        "files location",
        "russia flag",
        "russia hostname",
        "russia",
        "russia unknown",
        "hosting",
        "federation flag",
        "body",
        "gmt vary",
        "accept encoding",
        "gmt cache",
        "certificate",
        "pulse submit",
        "unknown aaaa",
        "search",
        "entries",
        "script domains",
        "script urls",
        "pdx cf"
      ],
      "references": [
        "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
        "Yare: compromised_site_redirector_fromcharcode",
        "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
        "Alerts: console_output has_pdb pe_unknown_resource_name",
        "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
        "Tipped: A targets AI and other cyber research findings.",
        "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
        "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
        "https://palapa.c.id\t (c.id)",
        "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
        "cedevice.io  \u2022 decagonsoftware.com",
        "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
        "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
        "pcup.gov.ph:",
        "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
        "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
        "https://elegantcosmedampyeah.pages.dev/",
        "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
        "inst.govelopscold.com",
        "https://feedback.ptv.vic.gov.au/360",
        "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
        "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
        "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d",
        "https://brand.centurylinktechnology.com",
        "https://prod.centurylinktechnology.com",
        "https://brand2.centurylinktechnology.com",
        "https://mobile-pocket-guide.centurylinktechnology.com",
        "UPX_OEP_place",
        "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
        "ASP. NET",
        "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
        "7box.vip"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan.Tofsee/Botx",
          "display_name": "Trojan.Tofsee/Botx",
          "target": null
        },
        {
          "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "target": null
        },
        {
          "id": "PWS:Win32/Axespec.A",
          "display_name": "PWS:Win32/Axespec.A",
          "target": "/malware/PWS:Win32/Axespec.A"
        },
        {
          "id": "Worm:Win32/Lightmoon.H",
          "display_name": "Worm:Win32/Lightmoon.H",
          "target": "/malware/Worm:Win32/Lightmoon.H"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1439",
          "name": "Eavesdrop on Insecure Network Communication",
          "display_name": "T1439 - Eavesdrop on Insecure Network Communication"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1078.004",
          "name": "Cloud Accounts",
          "display_name": "T1078.004 - Cloud Accounts"
        },
        {
          "id": "T1069.003",
          "name": "Cloud Groups",
          "display_name": "T1069.003 - Cloud Groups"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 102,
        "FileHash-SHA1": 59,
        "FileHash-SHA256": 1929,
        "domain": 854,
        "hostname": 2156,
        "URL": 4475,
        "SSLCertFingerprint": 9,
        "email": 7,
        "CVE": 1
      },
      "indicator_count": 9592,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68e2bb5d9ee8577ab5519f2c",
      "name": "Meritshealth with DoD links? ",
      "description": "",
      "modified": "2026-01-13T00:05:56.401000",
      "created": "2025-10-05T18:39:25.286000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "68e2b14d83bb63502feac65e",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1365,
        "URL": 11172,
        "hostname": 2780,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4420,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 20486,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "138 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68e2b14d83bb63502feac65e",
      "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
      "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
      "modified": "2026-01-07T00:00:30.717000",
      "created": "2025-10-05T17:56:29.109000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1328,
        "URL": 9931,
        "hostname": 2621,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4360,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 18989,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "144 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68e2b9fd811ffc6684ba25f7",
      "name": "Isolated DoD now DoW nodes - emotional commentary",
      "description": "*https://www.sentient.industries/\n*trk.b.jackrogersusa.com\n*http://trk.southerntide.com/\nOTX is auto populating this pulse. Let\u2019s see\u2026",
      "modified": "2025-11-04T18:01:18.650000",
      "created": "2025-10-05T18:33:33.277000",
      "tags": [
        "united",
        "present feb",
        "present may",
        "aaaa",
        "present jul",
        "passive dns",
        "ip address",
        "present dec",
        "present sep",
        "present jun",
        "url https",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "germany",
        "taiwan",
        "netherlands",
        "china",
        "search",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "ascii text",
        "size",
        "pattern match",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "body",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "title",
        "look",
        "verify",
        "restart",
        "filehashmd5",
        "hostname",
        "filehashsha256",
        "types of",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "ruby",
        "jeffrey reimer",
        "target",
        "tsara",
        "information",
        "capture",
        "gather victim",
        "report spam",
        "kill targets",
        "created",
        "starfield",
        "show technique",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1333,
        "domain": 355,
        "URL": 5874,
        "hostname": 1066,
        "FileHash-SHA1": 101,
        "FileHash-MD5": 88,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 8819,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "207 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://dweeseny.com/tabs/lense",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "error": "Expecting value: line 1 column 1 (char 0)",
    "indicator": "https://dweeseny.com/tabs/lense",
    "type": "URL"
  },
  "from_cache": true,
  "_cached_at": 1780234318.924107
}