{ "type": "URL", "indicator": "https://epm2-proxy.easyparksystem.net/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://epm2-proxy.easyparksystem.net/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4173101303, "indicator": "https://epm2-proxy.easyparksystem.net/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "69640c0afc9805a6fa2da07b", "name": "MUSO.AI Malware \u2018Incredimail\u2019 Palantir in use[OTX auto populated title -Tsara Brashears]", "description": "MUSO.Ai , Is have to do more research. Some searches on reports MUSO as an opt in resource for artist to view, sort, and manage legacy credits, MUSO also collects royalties. Research and investigation confirms no one on music team is associated with or l thinks they may have heard of MUSO. Is MUSO. AI Palantir customer or service ,spy app services by the folks at Palantir. . [otx auto pop praise: Tsara Brashears is the most popular songwriter in the world, but can you use the app to find out more about the artist and the musicians behind the tracks?] cute. \n#dembiak #palantir #muso #ai", "modified": "2026-02-10T20:03:47.214000", "created": "2026-01-11T20:46:02.176000", "tags": [ "lark kdence", "zack dare", "zafira", "jon bonus", "andy flebbe", "div div", "present nov", "a domains", "united", "script urls", "div a", "script domains", "discover", "moved", "insert", "x0 tw", "urls", "cloudfront x", "title error", "url analysis", "reverse dns", "servers", "name servers", "united states", "all ipv4", "aaaa", "ip address", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "evasion att", "t1480 execution", "ascii text", "mitre att", "pattern match", "null", "error", "click", "hybrid", "general", "local", "path", "starfield", "strings", "refresh", "tools", "meta", "onload", "span", "data upload", "extraction", "type", "extra", "referen https", "include review", "exclude sugges", "stop", "aivoes typ", "passive dns", "date", "united states", "status", "domain add", "files", "hostname", "read c", "medium", "search", "show", "memcommit", "high", "checks", "windows", "delete", "execution", "dock", "write", "persistence", "capture", "next", "amazon02", "as autonomous", "system", "asn16509", "domain", "current dns", "a record", "as16509", "december", "ip information", "ipasns ip", "google", "fastly", "googlecl", "akamaias", "cloudflar", "domain tree", "links ip", "address as", "cisco", "umbrella rank", "general full", "url https", "software", "resource hash", "protocol h2", "security tls", "hostname add", "challengescript", "captchascript", "name", "value", "source level", "url text", "automatic", "webgl", "please", "extr data", "data", "size", "title", "yara detections", "filehash", "av detections", "ids detections", "alerts", "analysis date", "file score", "low risk", "entries", "rgba", "unicode", "asnone", "malware", "port", "destination", "tlsv1", "tls handshake", "failure", "roboto", "msie", "windows nt", "wow64", "slcc2", "media center", "expiration", "url http", "no expiration", "present jan", "unknown ns", "certificate", "body", "present oct", "present may", "present dec", "present sep", "present feb", "showing", "next associated", "all se", "pulse pulses", "http", "files domain", "files related", "pulses none", "debiak", "tsara brashears", "ai", "palantir", "muso ai", "sort", "artists", "royalties", "music", "songwriter", "collect", "view", "malicious app", "false claims" ], "references": [ "https://credits.muso.ai/profile/ad62a9c1-de4a-4b3a-91d4-8f1ca6b5ad7a", "22.hio52.r.cloudfront.net", "us-gov-west-1.gov.reveal-global.com", "us-g0v-wact-1anvrav\u0645al=\u0635\u0639 \u0627\u062d\u0637\u0645\u0644\u0647", "MD5 be5eae9bd85769bce02d6e52a4927bcd Pulses Integrations C EXIF Data: HTML:Title\tINetSim default HTML page", "External Hosts Israel Unique Countries 2 Unique ASNs 2 IP", "ASN 82.80.204.63 www5.incredimail.com \u2022 Israel", "United States | ASNone 82.80.204.5 cen.incredibar.com \u2022 Israel", "AS8551 bezeq international-Itd 3.163.24.31 www5l.incredimail.com \u2022 Israel", "Antivirus Detections: Win.Malware.Incredimail-6804483-0 IDS Detections: Misspelled Mozilla User-Agent (Mozila)", "IP\u2019s Contacted : 82.80.204.63 3.163.24.31 82.80.204.5", "Domains Contacted: cen.incredibar.com www5l.incredimail.com www5.incredimail.com", "medallion-compute.washington.palantircloud.com \u2022 graviera-compute.palantirfedstart.com", "caerphilly-containers.palantirfedstart.com \u2022 equilibrium.palantirfoundry.com \u2022 palantirfoundry.com", "upstreamx.palantirfoundry.com \u2022 https://usw-2-dev.palantirfoundry.com", "https://upstreamx.palantirfoundry.com \u2022 edwards.palantirfoundry.com \u2022 stagwellmarketingcloud.palantirfoundry.com", "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master", "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master", "https://paloma.palantirfoundry.com https://lucyw.palantirfoundry.com \u2022 http://edwards.palantirfoundry.com/", "http://dasima-containers.palantirfoundry.com \u2022 http://usw-2-dev.palantirfoundry.com", "https://kt-presales.palantirfoundry.co \u2022 https://glare.palantirfoundry.com", "engage.palantirfoundry.com \u2022 http://engage.palantirfoundry.com", "https://equilibrium.palantirfoundry.com \u2022\u2019https://engage.palantirfoundry.com", "http://upstreamx.palantirfoundry.com/ \u2022 https://equilibrium.palantirfoundry.com/", "https://glare.pali om. \u2022 http://engage.palantirfou?", "What? patch.virtualworldweb.com \u2022 s.palantirfoundry.com \u2022 http://u tirfoundry.co", "(patch.virtualworldweb.com) why does this sound so creepy? DIT , simulation, OWO ,sentient weird.", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\t\u2022", "www.endgame \u2022 http://battlefront.com/matrixgames.html \u2022 prometheus.services.myscript.com - Wild!", "campdeadwood2026.com", "http://www.mobile-connection-alert.fyi/eb/bn/bn-9-nopop/9-nopop-1.html?var=&var2=&var3=$device=MOBILE&brand=Apple&model=iPhone&city=San%20Antonio&os=IOS&osversion=IOS%2011.4&country=US&countryname=United%20States&carrier=&referrerdomain=&language=en&connectiontype=CABLE&ip=76.185.246.58®ion=Texas&cep=W-gWTncHS9Jzl2WpUnQW3DI5dgjcKdwNWM11yWj-BtNBDFNTD52Baezh0F6DNui3qOYcu9zUPktlUvTulBlF6GONqMgW0w5NXdG42lOJGAp8P79kEUkAM3xGHBcIuf2PfSpz0mTGxnhbXyAteh4g-wCUR45SdW6fMtSANbFpDDpNDCq8LpN8mLeQJjdLUA_TGOXW9mubTgOyAGy", "Pornhub to your phone. Dumping or by request?", "https://soerkvingo.msnstyle.dk/vaginas-escort-girl-ukraina-pure-nudisme-dyresex-noveller-sukker-pris-porno-med-norsk-tale/", "www.killer333.club So I\u2019m right." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Incredimail-6804483-0", "display_name": "Win.Malware.Incredimail-6804483-0", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "TA0028", "name": "Persistence", "display_name": "TA0028 - Persistence" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1017", "name": "Application Deployment Software", "display_name": "T1017 - Application Deployment Software" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1608.001", "name": "Upload Malware", "display_name": "T1608.001 - Upload Malware" }, { "id": "T1598", "name": "Phishing for Information", "display_name": "T1598 - Phishing for Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10686, "hostname": 2427, "domain": 1094, "FileHash-MD5": 175, "FileHash-SHA1": 65, "FileHash-SHA256": 1118, "email": 4, "SSLCertFingerprint": 14 }, "indicator_count": 15583, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "110 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6961a8ed7b492f9e0ba38990", "name": "HeartSender.A and other Malware attacks originating from Palantirs Pahamify Pegasus", "description": "Pahamify Pegasus : HackTool \u2022 Speedcat \u2022 HeartSender.A \u2022 Zbot and other malware found.\nSearc begins with single FileHash referenced below. \nI\u2019m checking the processes and sharing it here one group at a time. Too much research at once could bring Amazon AWS down. Again.", "modified": "2026-02-09T00:04:37.974000", "created": "2026-01-10T01:18:36.999000", "tags": [ "read c", "write c", "port", "destination", "united", "medium", "as16509", "memcommit", "write", "execution", "dock", "persistence", "next executed", "commands graph", "tree", "sample hash", "passive dns", "present jan", "title error", "urls", "files", "date hash", "avast avg", "dynamicloader", "host", "utf8", "unicode text", "crlf line", "binary resource", "ms windows", "search", "intel", "pcspeedcat", "win32", "internal", "malware", "local", "unknown", "get na", "http", "okrnserver", "ip address", "http traffic", "guard", "powershell", "ipv4 add", "servers", "name servers", "capture", "link", "gateway", "tofsee att", "ck ids", "t1055", "injection", "t1071", "protocol", "t1573", "target", "url http", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "discovery att", "mitre att", "ck matrix", "ascii text", "hybrid", "general", "path", "click", "strings", "high", "etpro malware", "next", "stack", "format", "error", "unicode", "head http", "regsetvalueexa", "qt binary", "resource file", "pe32", "hostile", "unknown aaaa", "unknown ns", "x content", "gmt cache", "domain add", "title", "present sep", "a td", "td tr", "dir td", "td td", "present may", "present jun", "present apr", "present aug", "present oct", "head body", "gmt server", "index", "main", "accept", "status", "th tr", "moved", "record value", "expiration date", "germany unknown", "present dec", "cache control", "present nov", "max age1000000", "cookie", "hosting", "reverse dns", "location france", "france asn", "as16276", "trojandropper", "next associated", "mtb jan", "exploit", "emails", "trojan", "pegasus", "hostname add", "url analysis", "domain", "files ip", "address", "france unknown", "asn as16276", "backdoor", "entries", "setcookie", "twitter", "refloadapihash", "virtool", "show", "displayname", "windows", "rndhex", "tofsee", "stream", "encrypt", "push", "creation date", "france", "date", "body", "pup", "amazon", "amazon aws", "salesforce", "herokuappdev", "google", "igoogle", "monitored target", "cats" ], "references": [ "FileHash-SHA256\t9f66cab9d7c581cf2dd28b6ae3178bb3d38975ff257c3ffb67c3e89d0f7135ee", "https://otx.alienvault.com/indicator/ip/3.163.24.10", "External Hosts: 52.57.183.74\t access.pcspeedcat.com\taccess.pcspeedcat.com\tGermany\tAS16509 amazon.com inc\taccess.pcspeedcat.com Germany AS16509 amazon.", "External Hosts: 3.163.24.10\t www.pcspeedcat.com\twww.pcspeedcat.com\tUnited States ASNone", "https://otx.alienvault.com/indicator/hostname/pegasus.pahamify.com", "https://otx.alienvault.com/indicator/url/https://pegasus.pahamify.com/", "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "http://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "biblegateway.comwww.biblegateway.com \u2022 www.biblegateway.com", "Malicious Application Development: herokuappdev.com (Patter match 8 years +)", "direwolf-8b1a1bc476.staging.herokuappdev.com", "Malicious Application Development: herokuappdev.com (pattern matching spans 8+ years)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Generic-9871124-0", "display_name": "Win.Malware.Generic-9871124-0", "target": null }, { "id": "ALF:HackTool:MSIL/HeartSender.A", "display_name": "ALF:HackTool:MSIL/HeartSender.A", "target": null }, { "id": "Win.Malware.Speedcat-6957425", "display_name": "Win.Malware.Speedcat-6957425", "target": null }, { "id": "Tofsee Attack", "display_name": "Tofsee Attack", "target": null }, { "id": "Zbot", "display_name": "Zbot", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1608", "name": "Stage Capabilities", "display_name": "T1608 - Stage Capabilities" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" } ], "industries": [ "Civil Society", "Telecommunications", "Technology" ], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 404, "FileHash-SHA1": 286, "FileHash-SHA256": 1419, "SSLCertFingerprint": 7, "domain": 441, "URL": 4233, "hostname": 1217, "email": 10 }, "indicator_count": 8017, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "111 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6958372ef9da31513d96bebb", "name": "Connected-IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation", "description": "Retaliation? IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation for malicious control | found in the analytics of a highly target device: I\u2019ve included related pulses from 2 other threat responders and an Apple discussion post. Surprisingly, most of the IoC\u2019s pulsed came from one page of analytics. | \u2022 \"avconferenced\", \"procPath\" : \"\\/usr\\/libexec\\/avconferenced | 180.4.1.2 | a version of\npegasus found. | https://prometheus-pushgateway-internal.preview.tp-staging.com/\t\nhostname: prometheus.netmaker.vonnue.dev\t\nhostname: prometheus.dev.aws.finoa.io |\nSince Prometheus pulse . I realize now every Prometheus pulse illicits outrageous behavior.. Is this a secret society? Try to be more secretive. Owl heads in lawn. This behavior illicits investigation for a fix. Please STOP. I\u2019m done looking at Prometheus. Please stop leaving artifacts.", "modified": "2026-02-01T20:00:08.812000", "created": "2026-01-02T21:22:54.247000", "tags": [ "syscall", "nsrunloop", "objcclass", "region type", "start", "vsize", "prtmax shrmod", "region detailn", "unused space", "at startn", "guard", "urls", "url analysis", "verdict", "domain", "address", "location japan", "hikone", "japan asn", "as4713 ntt", "related tags", "none external", "aaaa", "united", "passive dns", "ip address", "japan", "present dec", "domain add", "files", "japan unknown", "present jul", "present oct", "present sep", "present aug", "present jun", "japan showing", "urls show", "date checked", "url hostname", "server response", "google safe", "reverse dns", "present nov", "present", "present may", "present mar", "present apr", "data upload", "extraction", "failed", "files ip", "moved", "gmt content", "ipv4 add", "location united", "title", "ipv4", "dns resolutions", "hostname add", "asn as4713", "all ipv4", "google", "ocn ntt", "googlecl", "http", "amazon02", "akamaias", "page url", "yahoojp", "december", "jp summary", "february", "asn15169", "tokyo", "kansas city", "asn396982", "asn30286", "asn16509", "cisco", "umbrella rank", "cisco umbrella", "rank", "kitashinagawa", "sureserver ev", "ca g3", "domains", "hashes", "microsoft", "docomo business", "ml14325", "as autonomous", "asn8075", "ip information", "ipasns ip", "detail domain", "domain tree", "links domain", "requested", "value", "automatic", "webgl", "please", "mr value", "muid value", "mjl function", "dcmlinker", "paq string", "kb script", "b image", "b script", "frame a344", "redirect chain", "kb document", "frame", "b xhr", "kb image", "fetch collect", "request chain", "redirected", "http redirect", "name servers", "redacted for", "servers", "unknown aaaa", "search", "for privacy", "domeny serwery", "verdana tahoma", "arial", "gmt contenttype", "meta", "small", "results jan", "present jan", "status", "record value", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "process details", "flag", "japan japan", "pattern match", "ascii text", "mitre att", "ck id", "null", "refresh", "span", "hybrid", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "learn", "name tactics", "suspicious", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "monitored target", "pulse submit", "wikipedia", "imap", "smtp", "ocn open", "discussion", "stub", "jprs database", "ocnnttocn", "maintenance", "outages notice", "lock status", "state", "connected", "organization", "type", "name", "server", "name server", "connected date", "algorithm", "key identifier", "data", "v3 serial", "number", "cjp ocybertrust", "ev ca", "g3 validity", "ku ontt", "docomo", "record type", "ttl value", "thumbprint", "emails", "date", "trojan", "pegasus", "title error", "hostname", "pulse pulses", "entries", "mtb apr", "lowfi", "win32", "a domains", "body", "worm", "virtool", "cybota", "showing", "palantir", "prometheus" ], "references": [ "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp", "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp", "ocn.ad.jp - Registrant Org: NTT Communications Corporation", "Page Title: \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN", "Nippon Telegraph and Telephone Corporation one governmental now privated", "computersandsoftware \u2022 portal sites \u2022 search engines and portals", "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com", "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2", "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80", "https://discussions.apple.com/thread/255214328?sortBy=rank", "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators", "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact", "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com", "swarm-foundry.com", "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org Domain kinkfuck.com \u2022 nobodycares.art", "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com", "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5", "server-3-164-143-102.nrt20.r.cloudfront.net", "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com", "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com", "https://ww41.porn25.com/", "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA", "If something curious is found on privatelybowen property we have a constitutional right to examine it.", "Other constitutional rights and privileges written in law where severe courses of action is allowed", "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..", "Device targeted with l RMS Modules by male in Denver, Co", "Attempts to clip target at high rate of speed.Seen again at her residence in October", "Target was monitored in store and followed home needed to stop multiple times , change routes.", "Multiple attackers. Don\u2019t believe me, look at the pulses. Caged in by male with deauther watch.", "Most of the people doing this are 50\u2019s plus, plus. There are youngsters but many grey haired , grandparents", "The older the smarter the way better. These people are brilliant , ruthless and dangerous", "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.", "Malicious activity seen since a Pulse regarding school outage.", "Location search was used to find device users address. It\u2019s with me.", "Delete service is being used on this Threat service", "Many indicators point to an IP this block is on.", "It\u2019s so out of hand,m for 16 people.", "https://prometheus-pushgateway-internal.preview.tp-staging.com/", "prometheus.netmaker.vonnue.dev", "prometheus.dev.aws.finoa.io", "Prometheus - Alien God? Morality through the eyes of the immoral", "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2879, "domain": 1372, "URL": 5788, "FileHash-SHA256": 1720, "CVE": 1, "FileHash-MD5": 238, "FileHash-SHA1": 241, "email": 13 }, "indicator_count": 12252, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "119 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://otx.alienvault.com/indicator/url/https://pegasus.pahamify.com/", "direwolf-8b1a1bc476.staging.herokuappdev.com", "https://discussions.apple.com/thread/255214328?sortBy=rank", "http://upstreamx.palantirfoundry.com/ \u2022 https://equilibrium.palantirfoundry.com/", "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master", "www.killer333.club So I\u2019m right.", "prometheus.netmaker.vonnue.dev", "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com", "Malicious activity seen since a Pulse regarding school outage.", "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com", "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp", "Malicious Application Development: herokuappdev.com (Patter match 8 years +)", "prometheus.dev.aws.finoa.io", "Antivirus Detections: Win.Malware.Incredimail-6804483-0 IDS Detections: Misspelled Mozilla User-Agent (Mozila)", "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.", "Multiple attackers. Don\u2019t believe me, look at the pulses. Caged in by male with deauther watch.", "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "server-3-164-143-102.nrt20.r.cloudfront.net", "http://www.mobile-connection-alert.fyi/eb/bn/bn-9-nopop/9-nopop-1.html?var=&var2=&var3=$device=MOBILE&brand=Apple&model=iPhone&city=San%20Antonio&os=IOS&osversion=IOS%2011.4&country=US&countryname=United%20States&carrier=&referrerdomain=&language=en&connectiontype=CABLE&ip=76.185.246.58®ion=Texas&cep=W-gWTncHS9Jzl2WpUnQW3DI5dgjcKdwNWM11yWj-BtNBDFNTD52Baezh0F6DNui3qOYcu9zUPktlUvTulBlF6GONqMgW0w5NXdG42lOJGAp8P79kEUkAM3xGHBcIuf2PfSpz0mTGxnhbXyAteh4g-wCUR45SdW6fMtSANbFpDDpNDCq8LpN8mLeQJjdLUA_TGOXW9mubTgOyAGy", "Pornhub to your phone. Dumping or by request?", "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80", "22.hio52.r.cloudfront.net", "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God.", "ASN 82.80.204.63 www5.incredimail.com \u2022 Israel", "engage.palantirfoundry.com \u2022 http://engage.palantirfoundry.com", "What? patch.virtualworldweb.com \u2022 s.palantirfoundry.com \u2022 http://u tirfoundry.co", "caerphilly-containers.palantirfedstart.com \u2022 equilibrium.palantirfoundry.com \u2022 palantirfoundry.com", "Most of the people doing this are 50\u2019s plus, plus. There are youngsters but many grey haired , grandparents", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\t\u2022", "Prometheus - Alien God? Morality through the eyes of the immoral", "It\u2019s so out of hand,m for 16 people.", "upstreamx.palantirfoundry.com \u2022 https://usw-2-dev.palantirfoundry.com", "http://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com", "IP\u2019s Contacted : 82.80.204.63 3.163.24.31 82.80.204.5", "Location search was used to find device users address. It\u2019s with me.", "https://equilibrium.palantirfoundry.com \u2022\u2019https://engage.palantirfoundry.com", "External Hosts: 52.57.183.74\t access.pcspeedcat.com\taccess.pcspeedcat.com\tGermany\tAS16509 amazon.com inc\taccess.pcspeedcat.com Germany AS16509 amazon.", "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com", "https://prometheus-pushgateway-internal.preview.tp-staging.com/", "https://soerkvingo.msnstyle.dk/vaginas-escort-girl-ukraina-pure-nudisme-dyresex-noveller-sukker-pris-porno-med-norsk-tale/", "https://ww41.porn25.com/", "https://upstreamx.palantirfoundry.com \u2022 edwards.palantirfoundry.com \u2022 stagwellmarketingcloud.palantirfoundry.com", "https://otx.alienvault.com/indicator/ip/3.163.24.10", "External Hosts: 3.163.24.10\t www.pcspeedcat.com\twww.pcspeedcat.com\tUnited States ASNone", "(patch.virtualworldweb.com) why does this sound so creepy? DIT , simulation, OWO ,sentient weird.", "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master", "ocn.ad.jp - Registrant Org: NTT Communications Corporation", "Other constitutional rights and privileges written in law where severe courses of action is allowed", "Device targeted with l RMS Modules by male in Denver, Co", "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp", "Domains Contacted: cen.incredibar.com www5l.incredimail.com www5.incredimail.com", "http://dasima-containers.palantirfoundry.com \u2022 http://usw-2-dev.palantirfoundry.com", "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org Domain kinkfuck.com \u2022 nobodycares.art", "Page Title: \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN", "External Hosts Israel Unique Countries 2 Unique ASNs 2 IP", "Target was monitored in store and followed home needed to stop multiple times , change routes.", "us-g0v-wact-1anvrav\u0645al=\u0635\u0639 \u0627\u062d\u0637\u0645\u0644\u0647", "https://credits.muso.ai/profile/ad62a9c1-de4a-4b3a-91d4-8f1ca6b5ad7a", "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com", "https://kt-presales.palantirfoundry.co \u2022 https://glare.palantirfoundry.com", "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA", "https://otx.alienvault.com/indicator/hostname/pegasus.pahamify.com", "Malicious Application Development: herokuappdev.com (pattern matching spans 8+ years)", "MD5 be5eae9bd85769bce02d6e52a4927bcd Pulses Integrations C EXIF Data: HTML:Title\tINetSim default HTML page", "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2", "Attempts to clip target at high rate of speed.Seen again at her residence in October", "FileHash-SHA256\t9f66cab9d7c581cf2dd28b6ae3178bb3d38975ff257c3ffb67c3e89d0f7135ee", "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact", "Delete service is being used on this Threat service", "computersandsoftware \u2022 portal sites \u2022 search engines and portals", "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5", "https://glare.pali om. \u2022 http://engage.palantirfou?", "The older the smarter the way better. These people are brilliant , ruthless and dangerous", "swarm-foundry.com", "us-gov-west-1.gov.reveal-global.com", "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..", "United States | ASNone 82.80.204.5 cen.incredibar.com \u2022 Israel", "www.endgame \u2022 http://battlefront.com/matrixgames.html \u2022 prometheus.services.myscript.com - Wild!", "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators", "If something curious is found on privatelybowen property we have a constitutional right to examine it.", "campdeadwood2026.com", "Nippon Telegraph and Telephone Corporation one governmental now privated", "biblegateway.comwww.biblegateway.com \u2022 www.biblegateway.com", "AS8551 bezeq international-Itd 3.163.24.31 www5l.incredimail.com \u2022 Israel", "medallion-compute.washington.palantircloud.com \u2022 graviera-compute.palantirfedstart.com", "Many indicators point to an IP this block is on.", "https://paloma.palantirfoundry.com https://lucyw.palantirfoundry.com \u2022 http://edwards.palantirfoundry.com/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Tofsee attack", "Alf:hacktool:msil/heartsender.a", "Win.malware.generic-9871124-0", "Win.malware.speedcat-6957425", "Win.malware.incredimail-6804483-0", "Zbot" ], "industries": [ "Technology", "Telecommunications", "Civil society" ], "unique_indicators": 35291 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/easyparksystem.net", "whois": "http://whois.domaintools.com/easyparksystem.net", "domain": "easyparksystem.net", "hostname": "epm2-proxy.easyparksystem.net" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "69640c0afc9805a6fa2da07b", "name": "MUSO.AI Malware \u2018Incredimail\u2019 Palantir in use[OTX auto populated title -Tsara Brashears]", "description": "MUSO.Ai , Is have to do more research. Some searches on reports MUSO as an opt in resource for artist to view, sort, and manage legacy credits, MUSO also collects royalties. Research and investigation confirms no one on music team is associated with or l thinks they may have heard of MUSO. Is MUSO. AI Palantir customer or service ,spy app services by the folks at Palantir. . [otx auto pop praise: Tsara Brashears is the most popular songwriter in the world, but can you use the app to find out more about the artist and the musicians behind the tracks?] cute. \n#dembiak #palantir #muso #ai", "modified": "2026-02-10T20:03:47.214000", "created": "2026-01-11T20:46:02.176000", "tags": [ "lark kdence", "zack dare", "zafira", "jon bonus", "andy flebbe", "div div", "present nov", "a domains", "united", "script urls", "div a", "script domains", "discover", "moved", "insert", "x0 tw", "urls", "cloudfront x", "title error", "url analysis", "reverse dns", "servers", "name servers", "united states", "all ipv4", "aaaa", "ip address", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "evasion att", "t1480 execution", "ascii text", "mitre att", "pattern match", "null", "error", "click", "hybrid", "general", "local", "path", "starfield", "strings", "refresh", "tools", "meta", "onload", "span", "data upload", "extraction", "type", "extra", "referen https", "include review", "exclude sugges", "stop", "aivoes typ", "passive dns", "date", "united states", "status", "domain add", "files", "hostname", "read c", "medium", "search", "show", "memcommit", "high", "checks", "windows", "delete", "execution", "dock", "write", "persistence", "capture", "next", "amazon02", "as autonomous", "system", "asn16509", "domain", "current dns", "a record", "as16509", "december", "ip information", "ipasns ip", "google", "fastly", "googlecl", "akamaias", "cloudflar", "domain tree", "links ip", "address as", "cisco", "umbrella rank", "general full", "url https", "software", "resource hash", "protocol h2", "security tls", "hostname add", "challengescript", "captchascript", "name", "value", "source level", "url text", "automatic", "webgl", "please", "extr data", "data", "size", "title", "yara detections", "filehash", "av detections", "ids detections", "alerts", "analysis date", "file score", "low risk", "entries", "rgba", "unicode", "asnone", "malware", "port", "destination", "tlsv1", "tls handshake", "failure", "roboto", "msie", "windows nt", "wow64", "slcc2", "media center", "expiration", "url http", "no expiration", "present jan", "unknown ns", "certificate", "body", "present oct", "present may", "present dec", "present sep", "present feb", "showing", "next associated", "all se", "pulse pulses", "http", "files domain", "files related", "pulses none", "debiak", "tsara brashears", "ai", "palantir", "muso ai", "sort", "artists", "royalties", "music", "songwriter", "collect", "view", "malicious app", "false claims" ], "references": [ "https://credits.muso.ai/profile/ad62a9c1-de4a-4b3a-91d4-8f1ca6b5ad7a", "22.hio52.r.cloudfront.net", "us-gov-west-1.gov.reveal-global.com", "us-g0v-wact-1anvrav\u0645al=\u0635\u0639 \u0627\u062d\u0637\u0645\u0644\u0647", "MD5 be5eae9bd85769bce02d6e52a4927bcd Pulses Integrations C EXIF Data: HTML:Title\tINetSim default HTML page", "External Hosts Israel Unique Countries 2 Unique ASNs 2 IP", "ASN 82.80.204.63 www5.incredimail.com \u2022 Israel", "United States | ASNone 82.80.204.5 cen.incredibar.com \u2022 Israel", "AS8551 bezeq international-Itd 3.163.24.31 www5l.incredimail.com \u2022 Israel", "Antivirus Detections: Win.Malware.Incredimail-6804483-0 IDS Detections: Misspelled Mozilla User-Agent (Mozila)", "IP\u2019s Contacted : 82.80.204.63 3.163.24.31 82.80.204.5", "Domains Contacted: cen.incredibar.com www5l.incredimail.com www5.incredimail.com", "medallion-compute.washington.palantircloud.com \u2022 graviera-compute.palantirfedstart.com", "caerphilly-containers.palantirfedstart.com \u2022 equilibrium.palantirfoundry.com \u2022 palantirfoundry.com", "upstreamx.palantirfoundry.com \u2022 https://usw-2-dev.palantirfoundry.com", "https://upstreamx.palantirfoundry.com \u2022 edwards.palantirfoundry.com \u2022 stagwellmarketingcloud.palantirfoundry.com", "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master", "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master", "https://paloma.palantirfoundry.com https://lucyw.palantirfoundry.com \u2022 http://edwards.palantirfoundry.com/", "http://dasima-containers.palantirfoundry.com \u2022 http://usw-2-dev.palantirfoundry.com", "https://kt-presales.palantirfoundry.co \u2022 https://glare.palantirfoundry.com", "engage.palantirfoundry.com \u2022 http://engage.palantirfoundry.com", "https://equilibrium.palantirfoundry.com \u2022\u2019https://engage.palantirfoundry.com", "http://upstreamx.palantirfoundry.com/ \u2022 https://equilibrium.palantirfoundry.com/", "https://glare.pali om. \u2022 http://engage.palantirfou?", "What? patch.virtualworldweb.com \u2022 s.palantirfoundry.com \u2022 http://u tirfoundry.co", "(patch.virtualworldweb.com) why does this sound so creepy? DIT , simulation, OWO ,sentient weird.", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\t\u2022", "www.endgame \u2022 http://battlefront.com/matrixgames.html \u2022 prometheus.services.myscript.com - Wild!", "campdeadwood2026.com", "http://www.mobile-connection-alert.fyi/eb/bn/bn-9-nopop/9-nopop-1.html?var=&var2=&var3=$device=MOBILE&brand=Apple&model=iPhone&city=San%20Antonio&os=IOS&osversion=IOS%2011.4&country=US&countryname=United%20States&carrier=&referrerdomain=&language=en&connectiontype=CABLE&ip=76.185.246.58®ion=Texas&cep=W-gWTncHS9Jzl2WpUnQW3DI5dgjcKdwNWM11yWj-BtNBDFNTD52Baezh0F6DNui3qOYcu9zUPktlUvTulBlF6GONqMgW0w5NXdG42lOJGAp8P79kEUkAM3xGHBcIuf2PfSpz0mTGxnhbXyAteh4g-wCUR45SdW6fMtSANbFpDDpNDCq8LpN8mLeQJjdLUA_TGOXW9mubTgOyAGy", "Pornhub to your phone. Dumping or by request?", "https://soerkvingo.msnstyle.dk/vaginas-escort-girl-ukraina-pure-nudisme-dyresex-noveller-sukker-pris-porno-med-norsk-tale/", "www.killer333.club So I\u2019m right." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Incredimail-6804483-0", "display_name": "Win.Malware.Incredimail-6804483-0", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "TA0028", "name": "Persistence", "display_name": "TA0028 - Persistence" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1017", "name": "Application Deployment Software", "display_name": "T1017 - Application Deployment Software" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1608.001", "name": "Upload Malware", "display_name": "T1608.001 - Upload Malware" }, { "id": "T1598", "name": "Phishing for Information", "display_name": "T1598 - Phishing for Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10686, "hostname": 2427, "domain": 1094, "FileHash-MD5": 175, "FileHash-SHA1": 65, "FileHash-SHA256": 1118, "email": 4, "SSLCertFingerprint": 14 }, "indicator_count": 15583, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "110 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6961a8ed7b492f9e0ba38990", "name": "HeartSender.A and other Malware attacks originating from Palantirs Pahamify Pegasus", "description": "Pahamify Pegasus : HackTool \u2022 Speedcat \u2022 HeartSender.A \u2022 Zbot and other malware found.\nSearc begins with single FileHash referenced below. \nI\u2019m checking the processes and sharing it here one group at a time. Too much research at once could bring Amazon AWS down. Again.", "modified": "2026-02-09T00:04:37.974000", "created": "2026-01-10T01:18:36.999000", "tags": [ "read c", "write c", "port", "destination", "united", "medium", "as16509", "memcommit", "write", "execution", "dock", "persistence", "next executed", "commands graph", "tree", "sample hash", "passive dns", "present jan", "title error", "urls", "files", "date hash", "avast avg", "dynamicloader", "host", "utf8", "unicode text", "crlf line", "binary resource", "ms windows", "search", "intel", "pcspeedcat", "win32", "internal", "malware", "local", "unknown", "get na", "http", "okrnserver", "ip address", "http traffic", "guard", "powershell", "ipv4 add", "servers", "name servers", "capture", "link", "gateway", "tofsee att", "ck ids", "t1055", "injection", "t1071", "protocol", "t1573", "target", "url http", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "discovery att", "mitre att", "ck matrix", "ascii text", "hybrid", "general", "path", "click", "strings", "high", "etpro malware", "next", "stack", "format", "error", "unicode", "head http", "regsetvalueexa", "qt binary", "resource file", "pe32", "hostile", "unknown aaaa", "unknown ns", "x content", "gmt cache", "domain add", "title", "present sep", "a td", "td tr", "dir td", "td td", "present may", "present jun", "present apr", "present aug", "present oct", "head body", "gmt server", "index", "main", "accept", "status", "th tr", "moved", "record value", "expiration date", "germany unknown", "present dec", "cache control", "present nov", "max age1000000", "cookie", "hosting", "reverse dns", "location france", "france asn", "as16276", "trojandropper", "next associated", "mtb jan", "exploit", "emails", "trojan", "pegasus", "hostname add", "url analysis", "domain", "files ip", "address", "france unknown", "asn as16276", "backdoor", "entries", "setcookie", "twitter", "refloadapihash", "virtool", "show", "displayname", "windows", "rndhex", "tofsee", "stream", "encrypt", "push", "creation date", "france", "date", "body", "pup", "amazon", "amazon aws", "salesforce", "herokuappdev", "google", "igoogle", "monitored target", "cats" ], "references": [ "FileHash-SHA256\t9f66cab9d7c581cf2dd28b6ae3178bb3d38975ff257c3ffb67c3e89d0f7135ee", "https://otx.alienvault.com/indicator/ip/3.163.24.10", "External Hosts: 52.57.183.74\t access.pcspeedcat.com\taccess.pcspeedcat.com\tGermany\tAS16509 amazon.com inc\taccess.pcspeedcat.com Germany AS16509 amazon.", "External Hosts: 3.163.24.10\t www.pcspeedcat.com\twww.pcspeedcat.com\tUnited States ASNone", "https://otx.alienvault.com/indicator/hostname/pegasus.pahamify.com", "https://otx.alienvault.com/indicator/url/https://pegasus.pahamify.com/", "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "http://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "biblegateway.comwww.biblegateway.com \u2022 www.biblegateway.com", "Malicious Application Development: herokuappdev.com (Patter match 8 years +)", "direwolf-8b1a1bc476.staging.herokuappdev.com", "Malicious Application Development: herokuappdev.com (pattern matching spans 8+ years)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Generic-9871124-0", "display_name": "Win.Malware.Generic-9871124-0", "target": null }, { "id": "ALF:HackTool:MSIL/HeartSender.A", "display_name": "ALF:HackTool:MSIL/HeartSender.A", "target": null }, { "id": "Win.Malware.Speedcat-6957425", "display_name": "Win.Malware.Speedcat-6957425", "target": null }, { "id": "Tofsee Attack", "display_name": "Tofsee Attack", "target": null }, { "id": "Zbot", "display_name": "Zbot", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1608", "name": "Stage Capabilities", "display_name": "T1608 - Stage Capabilities" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" } ], "industries": [ "Civil Society", "Telecommunications", "Technology" ], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 404, "FileHash-SHA1": 286, "FileHash-SHA256": 1419, "SSLCertFingerprint": 7, "domain": 441, "URL": 4233, "hostname": 1217, "email": 10 }, "indicator_count": 8017, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "111 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6958372ef9da31513d96bebb", "name": "Connected-IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation", "description": "Retaliation? IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation for malicious control | found in the analytics of a highly target device: I\u2019ve included related pulses from 2 other threat responders and an Apple discussion post. Surprisingly, most of the IoC\u2019s pulsed came from one page of analytics. | \u2022 \"avconferenced\", \"procPath\" : \"\\/usr\\/libexec\\/avconferenced | 180.4.1.2 | a version of\npegasus found. | https://prometheus-pushgateway-internal.preview.tp-staging.com/\t\nhostname: prometheus.netmaker.vonnue.dev\t\nhostname: prometheus.dev.aws.finoa.io |\nSince Prometheus pulse . I realize now every Prometheus pulse illicits outrageous behavior.. Is this a secret society? Try to be more secretive. Owl heads in lawn. This behavior illicits investigation for a fix. Please STOP. I\u2019m done looking at Prometheus. Please stop leaving artifacts.", "modified": "2026-02-01T20:00:08.812000", "created": "2026-01-02T21:22:54.247000", "tags": [ "syscall", "nsrunloop", "objcclass", "region type", "start", "vsize", "prtmax shrmod", "region detailn", "unused space", "at startn", "guard", "urls", "url analysis", "verdict", "domain", "address", "location japan", "hikone", "japan asn", "as4713 ntt", "related tags", "none external", "aaaa", "united", "passive dns", "ip address", "japan", "present dec", "domain add", "files", "japan unknown", "present jul", "present oct", "present sep", "present aug", "present jun", "japan showing", "urls show", "date checked", "url hostname", "server response", "google safe", "reverse dns", "present nov", "present", "present may", "present mar", "present apr", "data upload", "extraction", "failed", "files ip", "moved", "gmt content", "ipv4 add", "location united", "title", "ipv4", "dns resolutions", "hostname add", "asn as4713", "all ipv4", "google", "ocn ntt", "googlecl", "http", "amazon02", "akamaias", "page url", "yahoojp", "december", "jp summary", "february", "asn15169", "tokyo", "kansas city", "asn396982", "asn30286", "asn16509", "cisco", "umbrella rank", "cisco umbrella", "rank", "kitashinagawa", "sureserver ev", "ca g3", "domains", "hashes", "microsoft", "docomo business", "ml14325", "as autonomous", "asn8075", "ip information", "ipasns ip", "detail domain", "domain tree", "links domain", "requested", "value", "automatic", "webgl", "please", "mr value", "muid value", "mjl function", "dcmlinker", "paq string", "kb script", "b image", "b script", "frame a344", "redirect chain", "kb document", "frame", "b xhr", "kb image", "fetch collect", "request chain", "redirected", "http redirect", "name servers", "redacted for", "servers", "unknown aaaa", "search", "for privacy", "domeny serwery", "verdana tahoma", "arial", "gmt contenttype", "meta", "small", "results jan", "present jan", "status", "record value", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "process details", "flag", "japan japan", "pattern match", "ascii text", "mitre att", "ck id", "null", "refresh", "span", "hybrid", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "learn", "name tactics", "suspicious", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "monitored target", "pulse submit", "wikipedia", "imap", "smtp", "ocn open", "discussion", "stub", "jprs database", "ocnnttocn", "maintenance", "outages notice", "lock status", "state", "connected", "organization", "type", "name", "server", "name server", "connected date", "algorithm", "key identifier", "data", "v3 serial", "number", "cjp ocybertrust", "ev ca", "g3 validity", "ku ontt", "docomo", "record type", "ttl value", "thumbprint", "emails", "date", "trojan", "pegasus", "title error", "hostname", "pulse pulses", "entries", "mtb apr", "lowfi", "win32", "a domains", "body", "worm", "virtool", "cybota", "showing", "palantir", "prometheus" ], "references": [ "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp", "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp", "ocn.ad.jp - Registrant Org: NTT Communications Corporation", "Page Title: \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN", "Nippon Telegraph and Telephone Corporation one governmental now privated", "computersandsoftware \u2022 portal sites \u2022 search engines and portals", "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com", "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2", "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80", "https://discussions.apple.com/thread/255214328?sortBy=rank", "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators", "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact", "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com", "swarm-foundry.com", "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org Domain kinkfuck.com \u2022 nobodycares.art", "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com", "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5", "server-3-164-143-102.nrt20.r.cloudfront.net", "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com", "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com", "https://ww41.porn25.com/", "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA", "If something curious is found on privatelybowen property we have a constitutional right to examine it.", "Other constitutional rights and privileges written in law where severe courses of action is allowed", "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..", "Device targeted with l RMS Modules by male in Denver, Co", "Attempts to clip target at high rate of speed.Seen again at her residence in October", "Target was monitored in store and followed home needed to stop multiple times , change routes.", "Multiple attackers. Don\u2019t believe me, look at the pulses. Caged in by male with deauther watch.", "Most of the people doing this are 50\u2019s plus, plus. There are youngsters but many grey haired , grandparents", "The older the smarter the way better. These people are brilliant , ruthless and dangerous", "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.", "Malicious activity seen since a Pulse regarding school outage.", "Location search was used to find device users address. It\u2019s with me.", "Delete service is being used on this Threat service", "Many indicators point to an IP this block is on.", "It\u2019s so out of hand,m for 16 people.", "https://prometheus-pushgateway-internal.preview.tp-staging.com/", "prometheus.netmaker.vonnue.dev", "prometheus.dev.aws.finoa.io", "Prometheus - Alien God? Morality through the eyes of the immoral", "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2879, "domain": 1372, "URL": 5788, "FileHash-SHA256": 1720, "CVE": 1, "FileHash-MD5": 238, "FileHash-SHA1": 241, "email": 13 }, "indicator_count": 12252, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "119 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://epm2-proxy.easyparksystem.net/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://epm2-proxy.easyparksystem.net/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780270890.9242928 }