{
  "type": "URL",
  "indicator": "https://fantasy.oddsjam.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://fantasy.oddsjam.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3838502424,
      "indicator": "https://fantasy.oddsjam.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69bf8e2663d5480917ddb699",
          "name": "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender [i cloned OctoSeek] T8",
          "description": "",
          "modified": "2026-03-22T08:35:26.266000",
          "created": "2026-03-22T06:37:26.233000",
          "tags": [
            "united",
            "as393601 state",
            "a domains",
            "passive dns",
            "as397241",
            "certificate",
            "urls",
            "search",
            "showing",
            "entries",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "global g2",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "info",
            "record type",
            "ttl value",
            "all txt",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "resolutions",
            "historical ssl",
            "communicating",
            "problems",
            "parent domain",
            "njrat",
            "ransomware",
            "startpage",
            "historical",
            "malware",
            "execution",
            "threat roundup",
            "april",
            "september",
            "remcos rat",
            "august",
            "june",
            "qakbot",
            "push",
            "service",
            "privateloader",
            "amadey",
            "powershell",
            "qbot",
            "cobalt strike",
            "core",
            "hacktool",
            "november",
            "october",
            "roundup",
            "threat network",
            "cellbrite",
            "february",
            "emotet",
            "maze",
            "metro",
            "dark",
            "malicious",
            "team",
            "critical",
            "copy",
            "awful",
            "parallax rat",
            "banker",
            "keylogger",
            "dns replication",
            "date",
            "csc corporate",
            "domains",
            "code",
            "server",
            "registrar abuse",
            "registrar iana",
            "registry domain",
            "registrar url",
            "registrar",
            "contact phone",
            "apple ios",
            "quasar",
            "remcos",
            "ursnif",
            "chaos",
            "ransomexx",
            "azorult",
            "agent tesla",
            "evilnum",
            "asyncrat",
            "win32 exe",
            "wininit",
            "beta version",
            "cmstp",
            "taskscheduler",
            "ieudinit",
            "nat32",
            "certsentry",
            "type name",
            "wc3 rpg",
            "pegasus",
            "unknown",
            "domain",
            "servers",
            "germany unknown",
            "name servers",
            "status",
            "next",
            "as29066 host",
            "as133618",
            "cname",
            "as47846",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "encrypt",
            "china unknown",
            "as38365 beijing",
            "as134175 unit",
            "707713",
            "hong kong",
            "virgin islands",
            "as6461 zayo",
            "ransom",
            "exploit",
            "ipv4",
            "pulse submit",
            "url analysis",
            "trojan",
            "body",
            "click",
            "creation date",
            "emails",
            "expiration date",
            "domain privacy",
            "hostname",
            "dynamicloader",
            "state",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "show",
            "slcc2",
            "media center",
            "error",
            "delphi",
            "guard",
            "write",
            "win32",
            "target",
            "redir",
            "facebook",
            "dcom",
            "local",
            "delete",
            "utf8",
            "unicode text",
            "crlf line",
            "rgba",
            "yara detections",
            "default",
            "asnone",
            "get na",
            "dns lookup",
            "probe ms17010",
            "eternalblue",
            "playgame",
            "high",
            "related pulses",
            "yara rule",
            "anomalous file",
            "dynamic",
            "malware infection",
            "cnc",
            "procmem_yara",
            "antivm_generic_disk",
            "modify_proxy infostealer_cookies",
            "network_http",
            "anomalous_deletefile",
            "antidebug_guardpages",
            "powershell_request",
            "powershell_download",
            "as63949 linode",
            "mtb feb",
            "open ports",
            "backdoor",
            "gmt content",
            "trojandropper",
            "simda",
            "lockbit",
            "win.trojan",
            "midia-4",
            "floxif",
            "cryptowall",
            "brontok",
            "check in",
            "record value",
            "files",
            "location united",
            "america asn",
            "as16509",
            "download",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls http",
            "samples",
            "tsara brashears",
            "2nd corintnthians 4:8-9",
            "injection_inter_process",
            "injection_create_remote_thread",
            "persistence_autorun",
            "bypass_firewall",
            "disables_windowsupdate",
            "dynamic_function_loading",
            "http_request",
            "query",
            "delete c",
            "activity dns",
            "components",
            "file execution",
            "observed dns",
            "as4837 china",
            "nxdomain",
            "a nxdomain",
            "wannacry",
            "missouri",
            "safebae",
            "hallrender",
            "house.mo.gov",
            "typosquatting",
            "tactics",
            "google",
            "win64",
            "khtml",
            "gecko",
            "veryhigh",
            "aes256gcm",
            "dalles",
            "cookie",
            "urls https",
            "xpcegvo2adsnq",
            "mhkz",
            "mvi2",
            "keepaliveyes",
            "fexp24007246",
            "nsyt",
            "eva reimer",
            "daisy coleman",
            "brian sabey",
            "https://lawlink.com/documents/10935/blackbag-technologies-announ"
          ],
          "references": [
            "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
            "dns.msftncsi.com",
            "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
            "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "23.216.147.64",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
            "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
            "alohatube.xyz [BotNetwork]",
            "facebooksunglassshop.com",
            "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
            "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
            "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
            "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
            "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
            "remote.utorrent.com [remote router logins]",
            "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
            "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
            "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
            "http://tvm77.fashiongup.in/tracking/track-open",
            "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
            "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
            "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
            "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
            "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
            "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
            "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
            "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
            "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
            "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
            "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
            "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
            "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
            "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
            "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "China",
            "Australia",
            "Hong Kong"
          ],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "AsyncRAT",
              "display_name": "AsyncRAT",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Chaos",
              "display_name": "Chaos",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "EVILNUM",
              "display_name": "EVILNUM",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Keylogger",
              "display_name": "Keylogger",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "Parallax RAT",
              "display_name": "Parallax RAT",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Remcos RAT",
              "display_name": "Remcos RAT",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-336074",
              "display_name": "Win.Trojan.Agent-336074",
              "target": null
            },
            {
              "id": "Arid.Viper_CnC",
              "display_name": "Arid.Viper_CnC",
              "target": null
            },
            {
              "id": "WininiCrypt",
              "display_name": "WininiCrypt",
              "target": null
            },
            {
              "id": "PWS:Win32/QQpass.CI",
              "display_name": "PWS:Win32/QQpass.CI",
              "target": "/malware/PWS:Win32/QQpass.CI"
            },
            {
              "id": "Win.Trojan.Midia-4",
              "display_name": "Win.Trojan.Midia-4",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Win32/SocStealer!rfn",
              "display_name": "Win32/SocStealer!rfn",
              "target": null
            },
            {
              "id": "Backdoor.Win32.Shiz.ufj",
              "display_name": "Backdoor.Win32.Shiz.ufj",
              "target": null
            },
            {
              "id": "Email-Worm.Win32.Brontok.n",
              "display_name": "Email-Worm.Win32.Brontok.n",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65c91f2b7c03b480379ae4d1",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2668,
            "FileHash-SHA1": 2469,
            "FileHash-SHA256": 8054,
            "URL": 6185,
            "domain": 2421,
            "hostname": 3042,
            "CVE": 5,
            "email": 15,
            "CIDR": 1,
            "IPv4": 18
          },
          "indicator_count": 24878,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "28 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688716977e80a4274f2eafa9",
          "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
          "description": "Found in Bot joining Pulse.",
          "modified": "2025-08-27T06:03:05.020000",
          "created": "2025-07-28T06:20:07.660000",
          "tags": [
            "present jul",
            "united",
            "entries",
            "search",
            "moved",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "body",
            "meta",
            "passive dns",
            "next associated",
            "win32spigot apr",
            "title error",
            "ipv4 add",
            "pulse pulses",
            "urls",
            "files",
            "adaptivebee",
            "worm",
            "win32",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "location united",
            "asn asnone",
            "nameservers",
            "less whois",
            "registrar",
            "csc corporate",
            "status",
            "servers",
            "name servers",
            "hostname",
            "hostname add",
            "a domains",
            "script urls",
            "unknown aaaa",
            "technology one",
            "script script",
            "certificate",
            "null",
            "trojan",
            "twitter",
            "domain",
            "files ip",
            "address domain",
            "ip related",
            "pulses otx",
            "virtool",
            "http",
            "present jun",
            "present may",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "australia asn",
            "as55532 squiz",
            "dns resolutions",
            "overview ip",
            "address",
            "ipv4",
            "iocs",
            "data upload",
            "extraction",
            "ided iocs",
            "failed",
            "shaw",
            "ail tvnas",
            "rl irl",
            "domain add",
            "ostname add",
            "verdict",
            "show",
            "types",
            "type",
            "indicator data",
            "searc type",
            "a indicator",
            "data",
            "select across",
            "all pages",
            "domain domain",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "msie",
            "chrome",
            "present dec",
            "base",
            "read c",
            "port",
            "destination",
            "delete",
            "copy",
            "write",
            "memcommit",
            "cryptexportkey",
            "invalid pointer",
            "writeconsolea",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "size",
            "ascii text",
            "crlf line",
            "mitre att",
            "error",
            "click",
            "hybrid",
            "local",
            "path",
            "starfield",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "form",
            "adversaries",
            "windows nt",
            "generic http",
            "exe upload",
            "inbound",
            "outbound",
            "yara detections",
            "malware",
            "expiration date",
            "whois show",
            "name andrew",
            "bauer name",
            "div id",
            "beginstring",
            "beginerror",
            "script",
            "general",
            "cloud",
            "find",
            "footer",
            "ninite feb",
            "telper",
            "ninite mar",
            "ninite apr",
            "trojandropper",
            "mtb mar",
            "url https",
            "general full",
            "security tls",
            "software",
            "resource hash",
            "protocol h2",
            "frankfurt",
            "main",
            "germany",
            "input",
            "skype",
            "opciones",
            "july",
            "es form",
            "dom name",
            "post https",
            "imagen",
            "microsoft",
            "iniciar sesin",
            "value",
            "variables",
            "config",
            "debug",
            "loader",
            "geturl",
            "b function",
            "addlistener",
            "proof",
            "amazon02",
            "dk summary",
            "amazon rsa",
            "september",
            "browsing",
            "resource",
            "asn16509",
            "name value",
            "queueprogress",
            "timestamp input",
            "status actions"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 487,
            "FileHash-SHA1": 461,
            "URL": 10732,
            "domain": 1672,
            "email": 6,
            "hostname": 3039,
            "FileHash-SHA256": 2569,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 18973,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "235 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6647908c09468f42bc1249f1",
          "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
          "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
          "modified": "2025-03-01T04:59:57.222000",
          "created": "2024-05-17T17:14:52.317000",
          "tags": [
            "false",
            "true",
            "visible",
            "application",
            "microsoft teams",
            "microsoft azure",
            "office",
            "service",
            "dynamics",
            "hidden",
            "android",
            "explorer",
            "write",
            "connector",
            "test",
            "sharepoint",
            "live",
            "meister",
            "tools",
            "desktop",
            "spark",
            "front",
            "enterprise",
            "designer",
            "atlas",
            "premium",
            "assistant",
            "allow",
            "azureadmyorg",
            "game",
            "verify",
            "microsoft power",
            "channelsurfcli",
            "mtd1",
            "file transfer",
            "magnus",
            "microsoft crm",
            "youth"
          ],
          "references": [
            "All - EnterpriseAppsList.csv",
            "AppRegistrationList.csv",
            "https://tria.ge/240517-vc7c1shc62/behavioral1",
            "https://tria.ge/240517-vdwb5shc71/behavioral1",
            "https://tria.ge/240517-vqxezaaa33/behavioral1",
            "https://tria.ge/240517-t9pc2ahb2t",
            "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
            "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
            "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
            "Thor Scan: S-I9VvMTB6cZU",
            "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
            "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
            "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
            "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
            "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
            "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
            "https://tria.ge/240521-q4s79agb25/static1",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
            "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
            "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
            "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
            "https://www.hudsonrock.com/search?domain=ualberta.ca",
            "https://www.criminalip.io/domain/report?scan_id=13798622",
            "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
            "https://urlscan.io/search/#ualberta.ca",
            "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
            "https://sitereport.netcraft.com/?url=http://ualberta.ca",
            "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
            "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
            "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
            "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 7,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1703,
            "FileHash-SHA256": 90472,
            "URL": 99185,
            "domain": 82954,
            "hostname": 39041,
            "FileHash-SHA1": 1624,
            "email": 4658,
            "CVE": 12
          },
          "indicator_count": 319649,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "414 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c91f2b7c03b480379ae4d1",
          "name": "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender",
          "description": "1st time researching https://house.mo.gov/ & house.mo.gov. False arrest records of a target originated from Missouri. A glitch delete pulses & references in bulk.\nPegasus is the should be illegal. Destroying evidence of a truth that would be believed if heard. Spying for dirt to discredit. Target heavily deterred by cyber warfare,  healthcare fraud, injuries, financial difficulties due to hacked away businesses, strange shadowy government abused, in person stalking, threats and physical attacks, denied disability with a spinal cord injury?\nhttps://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
          "modified": "2024-03-12T15:03:06.954000",
          "created": "2024-02-11T19:25:31.451000",
          "tags": [
            "united",
            "as393601 state",
            "a domains",
            "passive dns",
            "as397241",
            "certificate",
            "urls",
            "search",
            "showing",
            "entries",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "global g2",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "info",
            "record type",
            "ttl value",
            "all txt",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "resolutions",
            "historical ssl",
            "communicating",
            "problems",
            "parent domain",
            "njrat",
            "ransomware",
            "startpage",
            "historical",
            "malware",
            "execution",
            "threat roundup",
            "april",
            "september",
            "remcos rat",
            "august",
            "june",
            "qakbot",
            "push",
            "service",
            "privateloader",
            "amadey",
            "powershell",
            "qbot",
            "cobalt strike",
            "core",
            "hacktool",
            "november",
            "october",
            "roundup",
            "threat network",
            "cellbrite",
            "february",
            "emotet",
            "maze",
            "metro",
            "dark",
            "malicious",
            "team",
            "critical",
            "copy",
            "awful",
            "parallax rat",
            "banker",
            "keylogger",
            "dns replication",
            "date",
            "csc corporate",
            "domains",
            "code",
            "server",
            "registrar abuse",
            "registrar iana",
            "registry domain",
            "registrar url",
            "registrar",
            "contact phone",
            "apple ios",
            "quasar",
            "remcos",
            "ursnif",
            "chaos",
            "ransomexx",
            "azorult",
            "agent tesla",
            "evilnum",
            "asyncrat",
            "win32 exe",
            "wininit",
            "beta version",
            "cmstp",
            "taskscheduler",
            "ieudinit",
            "nat32",
            "certsentry",
            "type name",
            "wc3 rpg",
            "pegasus",
            "unknown",
            "domain",
            "servers",
            "germany unknown",
            "name servers",
            "status",
            "next",
            "as29066 host",
            "as133618",
            "cname",
            "as47846",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "encrypt",
            "china unknown",
            "as38365 beijing",
            "as134175 unit",
            "707713",
            "hong kong",
            "virgin islands",
            "as6461 zayo",
            "ransom",
            "exploit",
            "ipv4",
            "pulse submit",
            "url analysis",
            "trojan",
            "body",
            "click",
            "creation date",
            "emails",
            "expiration date",
            "domain privacy",
            "hostname",
            "dynamicloader",
            "state",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "show",
            "slcc2",
            "media center",
            "error",
            "delphi",
            "guard",
            "write",
            "win32",
            "target",
            "redir",
            "facebook",
            "dcom",
            "local",
            "delete",
            "utf8",
            "unicode text",
            "crlf line",
            "rgba",
            "yara detections",
            "default",
            "asnone",
            "get na",
            "dns lookup",
            "probe ms17010",
            "eternalblue",
            "playgame",
            "high",
            "related pulses",
            "yara rule",
            "anomalous file",
            "dynamic",
            "malware infection",
            "cnc",
            "procmem_yara",
            "antivm_generic_disk",
            "modify_proxy infostealer_cookies",
            "network_http",
            "anomalous_deletefile",
            "antidebug_guardpages",
            "powershell_request",
            "powershell_download",
            "as63949 linode",
            "mtb feb",
            "open ports",
            "backdoor",
            "gmt content",
            "trojandropper",
            "simda",
            "lockbit",
            "win.trojan",
            "midia-4",
            "floxif",
            "cryptowall",
            "brontok",
            "check in",
            "record value",
            "files",
            "location united",
            "america asn",
            "as16509",
            "download",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls http",
            "samples",
            "tsara brashears",
            "2nd corintnthians 4:8-9",
            "injection_inter_process",
            "injection_create_remote_thread",
            "persistence_autorun",
            "bypass_firewall",
            "disables_windowsupdate",
            "dynamic_function_loading",
            "http_request",
            "query",
            "delete c",
            "activity dns",
            "components",
            "file execution",
            "observed dns",
            "as4837 china",
            "nxdomain",
            "a nxdomain",
            "wannacry",
            "missouri",
            "safebae",
            "hallrender",
            "house.mo.gov",
            "typosquatting",
            "tactics",
            "google",
            "win64",
            "khtml",
            "gecko",
            "veryhigh",
            "aes256gcm",
            "dalles",
            "cookie",
            "urls https",
            "xpcegvo2adsnq",
            "mhkz",
            "mvi2",
            "keepaliveyes",
            "fexp24007246",
            "nsyt",
            "eva reimer",
            "daisy coleman",
            "brian sabey",
            "https://lawlink.com/documents/10935/blackbag-technologies-announ"
          ],
          "references": [
            "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
            "dns.msftncsi.com",
            "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
            "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "23.216.147.64",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
            "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
            "alohatube.xyz [BotNetwork]",
            "facebooksunglassshop.com",
            "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
            "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
            "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
            "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
            "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
            "remote.utorrent.com [remote router logins]",
            "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
            "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
            "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
            "http://tvm77.fashiongup.in/tracking/track-open",
            "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
            "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
            "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
            "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
            "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
            "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
            "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
            "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
            "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
            "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
            "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
            "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
            "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
            "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
            "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "China",
            "Australia",
            "Hong Kong"
          ],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "AsyncRAT",
              "display_name": "AsyncRAT",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Chaos",
              "display_name": "Chaos",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "EVILNUM",
              "display_name": "EVILNUM",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Keylogger",
              "display_name": "Keylogger",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "Parallax RAT",
              "display_name": "Parallax RAT",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Remcos RAT",
              "display_name": "Remcos RAT",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-336074",
              "display_name": "Win.Trojan.Agent-336074",
              "target": null
            },
            {
              "id": "Arid.Viper_CnC",
              "display_name": "Arid.Viper_CnC",
              "target": null
            },
            {
              "id": "WininiCrypt",
              "display_name": "WininiCrypt",
              "target": null
            },
            {
              "id": "PWS:Win32/QQpass.CI",
              "display_name": "PWS:Win32/QQpass.CI",
              "target": "/malware/PWS:Win32/QQpass.CI"
            },
            {
              "id": "Win.Trojan.Midia-4",
              "display_name": "Win.Trojan.Midia-4",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Win32/SocStealer!rfn",
              "display_name": "Win32/SocStealer!rfn",
              "target": null
            },
            {
              "id": "Backdoor.Win32.Shiz.ufj",
              "display_name": "Backdoor.Win32.Shiz.ufj",
              "target": null
            },
            {
              "id": "Email-Worm.Win32.Brontok.n",
              "display_name": "Email-Worm.Win32.Brontok.n",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 148,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1373,
            "FileHash-SHA1": 1174,
            "FileHash-SHA256": 6417,
            "URL": 4264,
            "domain": 2304,
            "hostname": 2413,
            "CVE": 4,
            "email": 15,
            "CIDR": 1
          },
          "indicator_count": 17965,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "768 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "All - EnterpriseAppsList.csv",
        "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
        "dns.msftncsi.com",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "facebooksunglassshop.com",
        "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
        "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
        "AppRegistrationList.csv",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
        "23.216.147.64",
        "alohatube.xyz [BotNetwork]",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
        "https://urlscan.io/search/#ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List",
        "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
        "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
        "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "http://tvm77.fashiongup.in/tracking/track-open",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
        "remote.utorrent.com [remote router logins]",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
        "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
        "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
        "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
        "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
        "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://tria.ge/240521-q4s79agb25/static1",
        "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
        "Thor Scan: S-I9VvMTB6cZU",
        "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group"
          ],
          "malware_families": [
            "Hacktool",
            "Email-worm.win32.brontok.n",
            "Qakbot",
            "Win32/socstealer!rfn",
            "Ransomexx",
            "Win.trojan.agent-336074",
            "Eternalblue",
            "Pws:win32/qqpass.ci",
            "Emotet",
            "Win.trojan.midia-4",
            "Maze",
            "Lockbit",
            "Parallax rat",
            "Wannacry",
            "Cobalt strike",
            "Quasar rat",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "Ransomware",
            "Asyncrat",
            "Arid.viper_cnc",
            "Chaos",
            "Pegasus",
            "Ursnif",
            "Wininicrypt",
            "Njrat",
            "Dark",
            "Amadey",
            "Agent tesla",
            "Keylogger",
            "Remcos rat",
            "Backdoor.win32.shiz.ufj",
            "Azorult",
            "Qbot",
            "Evilnum"
          ],
          "industries": [
            "Healthcare",
            "Technology",
            "Education",
            "Government",
            "Telecommunications"
          ],
          "unique_indicators": 86237
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/oddsjam.com",
    "whois": "http://whois.domaintools.com/oddsjam.com",
    "domain": "oddsjam.com",
    "hostname": "fantasy.oddsjam.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69bf8e2663d5480917ddb699",
      "name": "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender [i cloned OctoSeek] T8",
      "description": "",
      "modified": "2026-03-22T08:35:26.266000",
      "created": "2026-03-22T06:37:26.233000",
      "tags": [
        "united",
        "as393601 state",
        "a domains",
        "passive dns",
        "as397241",
        "certificate",
        "urls",
        "search",
        "showing",
        "entries",
        "algorithm",
        "full name",
        "data",
        "v3 serial",
        "number",
        "cus cndigicert",
        "global g2",
        "tls rsa",
        "sha256",
        "ca1 odigicert",
        "info",
        "record type",
        "ttl value",
        "all txt",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "resolutions",
        "historical ssl",
        "communicating",
        "problems",
        "parent domain",
        "njrat",
        "ransomware",
        "startpage",
        "historical",
        "malware",
        "execution",
        "threat roundup",
        "april",
        "september",
        "remcos rat",
        "august",
        "june",
        "qakbot",
        "push",
        "service",
        "privateloader",
        "amadey",
        "powershell",
        "qbot",
        "cobalt strike",
        "core",
        "hacktool",
        "november",
        "october",
        "roundup",
        "threat network",
        "cellbrite",
        "february",
        "emotet",
        "maze",
        "metro",
        "dark",
        "malicious",
        "team",
        "critical",
        "copy",
        "awful",
        "parallax rat",
        "banker",
        "keylogger",
        "dns replication",
        "date",
        "csc corporate",
        "domains",
        "code",
        "server",
        "registrar abuse",
        "registrar iana",
        "registry domain",
        "registrar url",
        "registrar",
        "contact phone",
        "apple ios",
        "quasar",
        "remcos",
        "ursnif",
        "chaos",
        "ransomexx",
        "azorult",
        "agent tesla",
        "evilnum",
        "asyncrat",
        "win32 exe",
        "wininit",
        "beta version",
        "cmstp",
        "taskscheduler",
        "ieudinit",
        "nat32",
        "certsentry",
        "type name",
        "wc3 rpg",
        "pegasus",
        "unknown",
        "domain",
        "servers",
        "germany unknown",
        "name servers",
        "status",
        "next",
        "as29066 host",
        "as133618",
        "cname",
        "as47846",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "encrypt",
        "china unknown",
        "as38365 beijing",
        "as134175 unit",
        "707713",
        "hong kong",
        "virgin islands",
        "as6461 zayo",
        "ransom",
        "exploit",
        "ipv4",
        "pulse submit",
        "url analysis",
        "trojan",
        "body",
        "click",
        "creation date",
        "emails",
        "expiration date",
        "domain privacy",
        "hostname",
        "dynamicloader",
        "state",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "show",
        "slcc2",
        "media center",
        "error",
        "delphi",
        "guard",
        "write",
        "win32",
        "target",
        "redir",
        "facebook",
        "dcom",
        "local",
        "delete",
        "utf8",
        "unicode text",
        "crlf line",
        "rgba",
        "yara detections",
        "default",
        "asnone",
        "get na",
        "dns lookup",
        "probe ms17010",
        "eternalblue",
        "playgame",
        "high",
        "related pulses",
        "yara rule",
        "anomalous file",
        "dynamic",
        "malware infection",
        "cnc",
        "procmem_yara",
        "antivm_generic_disk",
        "modify_proxy infostealer_cookies",
        "network_http",
        "anomalous_deletefile",
        "antidebug_guardpages",
        "powershell_request",
        "powershell_download",
        "as63949 linode",
        "mtb feb",
        "open ports",
        "backdoor",
        "gmt content",
        "trojandropper",
        "simda",
        "lockbit",
        "win.trojan",
        "midia-4",
        "floxif",
        "cryptowall",
        "brontok",
        "check in",
        "record value",
        "files",
        "location united",
        "america asn",
        "as16509",
        "download",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "urls http",
        "samples",
        "tsara brashears",
        "2nd corintnthians 4:8-9",
        "injection_inter_process",
        "injection_create_remote_thread",
        "persistence_autorun",
        "bypass_firewall",
        "disables_windowsupdate",
        "dynamic_function_loading",
        "http_request",
        "query",
        "delete c",
        "activity dns",
        "components",
        "file execution",
        "observed dns",
        "as4837 china",
        "nxdomain",
        "a nxdomain",
        "wannacry",
        "missouri",
        "safebae",
        "hallrender",
        "house.mo.gov",
        "typosquatting",
        "tactics",
        "google",
        "win64",
        "khtml",
        "gecko",
        "veryhigh",
        "aes256gcm",
        "dalles",
        "cookie",
        "urls https",
        "xpcegvo2adsnq",
        "mhkz",
        "mvi2",
        "keepaliveyes",
        "fexp24007246",
        "nsyt",
        "eva reimer",
        "daisy coleman",
        "brian sabey",
        "https://lawlink.com/documents/10935/blackbag-technologies-announ"
      ],
      "references": [
        "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
        "dns.msftncsi.com",
        "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
        "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "23.216.147.64",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
        "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
        "alohatube.xyz [BotNetwork]",
        "facebooksunglassshop.com",
        "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
        "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
        "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
        "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
        "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
        "remote.utorrent.com [remote router logins]",
        "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
        "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
        "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
        "http://tvm77.fashiongup.in/tracking/track-open",
        "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
        "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
        "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
        "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
        "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
        "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
        "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
        "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
        "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
        "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
        "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
        "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
        "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
        "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
        "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [
        "United States of America",
        "China",
        "Australia",
        "Hong Kong"
      ],
      "malware_families": [
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "AsyncRAT",
          "display_name": "AsyncRAT",
          "target": null
        },
        {
          "id": "AZORult",
          "display_name": "AZORult",
          "target": null
        },
        {
          "id": "Chaos",
          "display_name": "Chaos",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "EVILNUM",
          "display_name": "EVILNUM",
          "target": null
        },
        {
          "id": "Dark",
          "display_name": "Dark",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Keylogger",
          "display_name": "Keylogger",
          "target": null
        },
        {
          "id": "Maze",
          "display_name": "Maze",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "Parallax RAT",
          "display_name": "Parallax RAT",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Remcos RAT",
          "display_name": "Remcos RAT",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-336074",
          "display_name": "Win.Trojan.Agent-336074",
          "target": null
        },
        {
          "id": "Arid.Viper_CnC",
          "display_name": "Arid.Viper_CnC",
          "target": null
        },
        {
          "id": "WininiCrypt",
          "display_name": "WininiCrypt",
          "target": null
        },
        {
          "id": "PWS:Win32/QQpass.CI",
          "display_name": "PWS:Win32/QQpass.CI",
          "target": "/malware/PWS:Win32/QQpass.CI"
        },
        {
          "id": "Win.Trojan.Midia-4",
          "display_name": "Win.Trojan.Midia-4",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Win32/SocStealer!rfn",
          "display_name": "Win32/SocStealer!rfn",
          "target": null
        },
        {
          "id": "Backdoor.Win32.Shiz.ufj",
          "display_name": "Backdoor.Win32.Shiz.ufj",
          "target": null
        },
        {
          "id": "Email-Worm.Win32.Brontok.n",
          "display_name": "Email-Worm.Win32.Brontok.n",
          "target": null
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "WannaCry",
          "display_name": "WannaCry",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65c91f2b7c03b480379ae4d1",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2668,
        "FileHash-SHA1": 2469,
        "FileHash-SHA256": 8054,
        "URL": 6185,
        "domain": 2421,
        "hostname": 3042,
        "CVE": 5,
        "email": 15,
        "CIDR": 1,
        "IPv4": 18
      },
      "indicator_count": 24878,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "28 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688716977e80a4274f2eafa9",
      "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
      "description": "Found in Bot joining Pulse.",
      "modified": "2025-08-27T06:03:05.020000",
      "created": "2025-07-28T06:20:07.660000",
      "tags": [
        "present jul",
        "united",
        "entries",
        "search",
        "moved",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "body",
        "meta",
        "passive dns",
        "next associated",
        "win32spigot apr",
        "title error",
        "ipv4 add",
        "pulse pulses",
        "urls",
        "files",
        "adaptivebee",
        "worm",
        "win32",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "location united",
        "asn asnone",
        "nameservers",
        "less whois",
        "registrar",
        "csc corporate",
        "status",
        "servers",
        "name servers",
        "hostname",
        "hostname add",
        "a domains",
        "script urls",
        "unknown aaaa",
        "technology one",
        "script script",
        "certificate",
        "null",
        "trojan",
        "twitter",
        "domain",
        "files ip",
        "address domain",
        "ip related",
        "pulses otx",
        "virtool",
        "http",
        "present jun",
        "present may",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "australia asn",
        "as55532 squiz",
        "dns resolutions",
        "overview ip",
        "address",
        "ipv4",
        "iocs",
        "data upload",
        "extraction",
        "ided iocs",
        "failed",
        "shaw",
        "ail tvnas",
        "rl irl",
        "domain add",
        "ostname add",
        "verdict",
        "show",
        "types",
        "type",
        "indicator data",
        "searc type",
        "a indicator",
        "data",
        "select across",
        "all pages",
        "domain domain",
        "checked url",
        "hostname server",
        "response ip",
        "address google",
        "safe browsing",
        "msie",
        "chrome",
        "present dec",
        "base",
        "read c",
        "port",
        "destination",
        "delete",
        "copy",
        "write",
        "memcommit",
        "cryptexportkey",
        "invalid pointer",
        "writeconsolea",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "size",
        "ascii text",
        "crlf line",
        "mitre att",
        "error",
        "click",
        "hybrid",
        "local",
        "path",
        "starfield",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "form",
        "adversaries",
        "windows nt",
        "generic http",
        "exe upload",
        "inbound",
        "outbound",
        "yara detections",
        "malware",
        "expiration date",
        "whois show",
        "name andrew",
        "bauer name",
        "div id",
        "beginstring",
        "beginerror",
        "script",
        "general",
        "cloud",
        "find",
        "footer",
        "ninite feb",
        "telper",
        "ninite mar",
        "ninite apr",
        "trojandropper",
        "mtb mar",
        "url https",
        "general full",
        "security tls",
        "software",
        "resource hash",
        "protocol h2",
        "frankfurt",
        "main",
        "germany",
        "input",
        "skype",
        "opciones",
        "july",
        "es form",
        "dom name",
        "post https",
        "imagen",
        "microsoft",
        "iniciar sesin",
        "value",
        "variables",
        "config",
        "debug",
        "loader",
        "geturl",
        "b function",
        "addlistener",
        "proof",
        "amazon02",
        "dk summary",
        "amazon rsa",
        "september",
        "browsing",
        "resource",
        "asn16509",
        "name value",
        "queueprogress",
        "timestamp input",
        "status actions"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 487,
        "FileHash-SHA1": 461,
        "URL": 10732,
        "domain": 1672,
        "email": 6,
        "hostname": 3039,
        "FileHash-SHA256": 2569,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 18973,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "235 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68858e8244c8db854e8947c1",
      "name": "Goodreads Malware",
      "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
      "modified": "2025-08-26T01:03:19.405000",
      "created": "2025-07-27T02:27:14.517000",
      "tags": [
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "united",
        "flag united",
        "present jun",
        "present may",
        "present apr",
        "search",
        "moved",
        "creation date",
        "record value",
        "date",
        "body",
        "meta",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "memcommit",
        "value1",
        "partnerid4146",
        "username",
        "gamesessionid",
        "port",
        "destination",
        "regsetvalueexa",
        "mozilla",
        "write",
        "persistence",
        "execution",
        "malware",
        "copy",
        "next",
        "process32nextw",
        "show",
        "entries",
        "module load",
        "t1129",
        "intel",
        "ms windows",
        "showing",
        "t1045",
        "win32",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "pattern match",
        "ascii text",
        "null",
        "error",
        "starfield",
        "click",
        "hybrid",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "smbds ipc",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "yara detections",
        "nrv2x",
        "upxoepplace"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 155,
        "hostname": 1237,
        "FileHash-SHA256": 1141,
        "domain": 574,
        "URL": 4593,
        "FileHash-SHA1": 139,
        "email": 1,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 7848,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "236 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6647908c09468f42bc1249f1",
      "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
      "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
      "modified": "2025-03-01T04:59:57.222000",
      "created": "2024-05-17T17:14:52.317000",
      "tags": [
        "false",
        "true",
        "visible",
        "application",
        "microsoft teams",
        "microsoft azure",
        "office",
        "service",
        "dynamics",
        "hidden",
        "android",
        "explorer",
        "write",
        "connector",
        "test",
        "sharepoint",
        "live",
        "meister",
        "tools",
        "desktop",
        "spark",
        "front",
        "enterprise",
        "designer",
        "atlas",
        "premium",
        "assistant",
        "allow",
        "azureadmyorg",
        "game",
        "verify",
        "microsoft power",
        "channelsurfcli",
        "mtd1",
        "file transfer",
        "magnus",
        "microsoft crm",
        "youth"
      ],
      "references": [
        "All - EnterpriseAppsList.csv",
        "AppRegistrationList.csv",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Healthcare",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 7,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1703,
        "FileHash-SHA256": 90472,
        "URL": 99185,
        "domain": 82954,
        "hostname": 39041,
        "FileHash-SHA1": 1624,
        "email": 4658,
        "CVE": 12
      },
      "indicator_count": 319649,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "414 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c91f2b7c03b480379ae4d1",
      "name": "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender",
      "description": "1st time researching https://house.mo.gov/ & house.mo.gov. False arrest records of a target originated from Missouri. A glitch delete pulses & references in bulk.\nPegasus is the should be illegal. Destroying evidence of a truth that would be believed if heard. Spying for dirt to discredit. Target heavily deterred by cyber warfare,  healthcare fraud, injuries, financial difficulties due to hacked away businesses, strange shadowy government abused, in person stalking, threats and physical attacks, denied disability with a spinal cord injury?\nhttps://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
      "modified": "2024-03-12T15:03:06.954000",
      "created": "2024-02-11T19:25:31.451000",
      "tags": [
        "united",
        "as393601 state",
        "a domains",
        "passive dns",
        "as397241",
        "certificate",
        "urls",
        "search",
        "showing",
        "entries",
        "algorithm",
        "full name",
        "data",
        "v3 serial",
        "number",
        "cus cndigicert",
        "global g2",
        "tls rsa",
        "sha256",
        "ca1 odigicert",
        "info",
        "record type",
        "ttl value",
        "all txt",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "resolutions",
        "historical ssl",
        "communicating",
        "problems",
        "parent domain",
        "njrat",
        "ransomware",
        "startpage",
        "historical",
        "malware",
        "execution",
        "threat roundup",
        "april",
        "september",
        "remcos rat",
        "august",
        "june",
        "qakbot",
        "push",
        "service",
        "privateloader",
        "amadey",
        "powershell",
        "qbot",
        "cobalt strike",
        "core",
        "hacktool",
        "november",
        "october",
        "roundup",
        "threat network",
        "cellbrite",
        "february",
        "emotet",
        "maze",
        "metro",
        "dark",
        "malicious",
        "team",
        "critical",
        "copy",
        "awful",
        "parallax rat",
        "banker",
        "keylogger",
        "dns replication",
        "date",
        "csc corporate",
        "domains",
        "code",
        "server",
        "registrar abuse",
        "registrar iana",
        "registry domain",
        "registrar url",
        "registrar",
        "contact phone",
        "apple ios",
        "quasar",
        "remcos",
        "ursnif",
        "chaos",
        "ransomexx",
        "azorult",
        "agent tesla",
        "evilnum",
        "asyncrat",
        "win32 exe",
        "wininit",
        "beta version",
        "cmstp",
        "taskscheduler",
        "ieudinit",
        "nat32",
        "certsentry",
        "type name",
        "wc3 rpg",
        "pegasus",
        "unknown",
        "domain",
        "servers",
        "germany unknown",
        "name servers",
        "status",
        "next",
        "as29066 host",
        "as133618",
        "cname",
        "as47846",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "encrypt",
        "china unknown",
        "as38365 beijing",
        "as134175 unit",
        "707713",
        "hong kong",
        "virgin islands",
        "as6461 zayo",
        "ransom",
        "exploit",
        "ipv4",
        "pulse submit",
        "url analysis",
        "trojan",
        "body",
        "click",
        "creation date",
        "emails",
        "expiration date",
        "domain privacy",
        "hostname",
        "dynamicloader",
        "state",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "show",
        "slcc2",
        "media center",
        "error",
        "delphi",
        "guard",
        "write",
        "win32",
        "target",
        "redir",
        "facebook",
        "dcom",
        "local",
        "delete",
        "utf8",
        "unicode text",
        "crlf line",
        "rgba",
        "yara detections",
        "default",
        "asnone",
        "get na",
        "dns lookup",
        "probe ms17010",
        "eternalblue",
        "playgame",
        "high",
        "related pulses",
        "yara rule",
        "anomalous file",
        "dynamic",
        "malware infection",
        "cnc",
        "procmem_yara",
        "antivm_generic_disk",
        "modify_proxy infostealer_cookies",
        "network_http",
        "anomalous_deletefile",
        "antidebug_guardpages",
        "powershell_request",
        "powershell_download",
        "as63949 linode",
        "mtb feb",
        "open ports",
        "backdoor",
        "gmt content",
        "trojandropper",
        "simda",
        "lockbit",
        "win.trojan",
        "midia-4",
        "floxif",
        "cryptowall",
        "brontok",
        "check in",
        "record value",
        "files",
        "location united",
        "america asn",
        "as16509",
        "download",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "urls http",
        "samples",
        "tsara brashears",
        "2nd corintnthians 4:8-9",
        "injection_inter_process",
        "injection_create_remote_thread",
        "persistence_autorun",
        "bypass_firewall",
        "disables_windowsupdate",
        "dynamic_function_loading",
        "http_request",
        "query",
        "delete c",
        "activity dns",
        "components",
        "file execution",
        "observed dns",
        "as4837 china",
        "nxdomain",
        "a nxdomain",
        "wannacry",
        "missouri",
        "safebae",
        "hallrender",
        "house.mo.gov",
        "typosquatting",
        "tactics",
        "google",
        "win64",
        "khtml",
        "gecko",
        "veryhigh",
        "aes256gcm",
        "dalles",
        "cookie",
        "urls https",
        "xpcegvo2adsnq",
        "mhkz",
        "mvi2",
        "keepaliveyes",
        "fexp24007246",
        "nsyt",
        "eva reimer",
        "daisy coleman",
        "brian sabey",
        "https://lawlink.com/documents/10935/blackbag-technologies-announ"
      ],
      "references": [
        "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
        "dns.msftncsi.com",
        "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
        "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "23.216.147.64",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
        "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
        "alohatube.xyz [BotNetwork]",
        "facebooksunglassshop.com",
        "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
        "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
        "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
        "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
        "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
        "remote.utorrent.com [remote router logins]",
        "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
        "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
        "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
        "http://tvm77.fashiongup.in/tracking/track-open",
        "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
        "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
        "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
        "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
        "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
        "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
        "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
        "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
        "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
        "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
        "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
        "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
        "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
        "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
        "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [
        "United States of America",
        "China",
        "Australia",
        "Hong Kong"
      ],
      "malware_families": [
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "AsyncRAT",
          "display_name": "AsyncRAT",
          "target": null
        },
        {
          "id": "AZORult",
          "display_name": "AZORult",
          "target": null
        },
        {
          "id": "Chaos",
          "display_name": "Chaos",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "EVILNUM",
          "display_name": "EVILNUM",
          "target": null
        },
        {
          "id": "Dark",
          "display_name": "Dark",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Keylogger",
          "display_name": "Keylogger",
          "target": null
        },
        {
          "id": "Maze",
          "display_name": "Maze",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "Parallax RAT",
          "display_name": "Parallax RAT",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Remcos RAT",
          "display_name": "Remcos RAT",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-336074",
          "display_name": "Win.Trojan.Agent-336074",
          "target": null
        },
        {
          "id": "Arid.Viper_CnC",
          "display_name": "Arid.Viper_CnC",
          "target": null
        },
        {
          "id": "WininiCrypt",
          "display_name": "WininiCrypt",
          "target": null
        },
        {
          "id": "PWS:Win32/QQpass.CI",
          "display_name": "PWS:Win32/QQpass.CI",
          "target": "/malware/PWS:Win32/QQpass.CI"
        },
        {
          "id": "Win.Trojan.Midia-4",
          "display_name": "Win.Trojan.Midia-4",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Win32/SocStealer!rfn",
          "display_name": "Win32/SocStealer!rfn",
          "target": null
        },
        {
          "id": "Backdoor.Win32.Shiz.ufj",
          "display_name": "Backdoor.Win32.Shiz.ufj",
          "target": null
        },
        {
          "id": "Email-Worm.Win32.Brontok.n",
          "display_name": "Email-Worm.Win32.Brontok.n",
          "target": null
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "WannaCry",
          "display_name": "WannaCry",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 148,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1373,
        "FileHash-SHA1": 1174,
        "FileHash-SHA256": 6417,
        "URL": 4264,
        "domain": 2304,
        "hostname": 2413,
        "CVE": 4,
        "email": 15,
        "CIDR": 1
      },
      "indicator_count": 17965,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "768 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://fantasy.oddsjam.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://fantasy.oddsjam.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638965.9298124
}