{
  "type": "URL",
  "indicator": "https://glance.com/us/about-us",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://glance.com/us/about-us",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4142060223,
      "indicator": "https://glance.com/us/about-us",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69612a0df518040b20932bef",
          "name": "Pahamify Pegasus | Palantir Malicious delivery via Bible app downloaded from iOS App Store",
          "description": "Pahamify Pegasus | Requires much further research.\nWorking backwards: Targeted device had a Bible Gateway app download by target from both iOS and Android devices. As per report each time app was accessed, iOS became glitched, passwords stolen, drive by compromise on lock screen prompted target to review app. She found the app login was changed to an unknown users name. I tested a (Bible Gateway) URI to see if her belief BG was a honey pot was true. \nThis may take 2-3 more rounds of research. \nIs Pegasus. Is Palantir. Is intrusive and malicious.\n\n[OTC auto generated Title: 2 Timothy 3 NIV - But mark this: There will be terrible - Bible Gateway]",
          "modified": "2026-02-08T15:00:50.749000",
          "created": "2026-01-09T16:17:17.632000",
          "tags": [
            "defense evasion",
            "cor ta0011",
            "techni process",
            "application l",
            "encrypted ch",
            "christ jesus",
            "just",
            "final charge",
            "timothy10",
            "antioch",
            "iconium",
            "lystra",
            "lord",
            "holy scriptures",
            "scripture",
            "bible gateway",
            "no expiration",
            "expiration",
            "a domains",
            "present sep",
            "united",
            "present jun",
            "meta",
            "present oct",
            "present aug",
            "servers",
            "title",
            "data upload",
            "extraction",
            "palantir foundry",
            "listeners",
            "dev",
            "redirects",
            "redirect health",
            "health data",
            "utc google",
            "utc na",
            "script",
            "utc amazon",
            "bible",
            "meta tags",
            "read",
            "bible reading",
            "trackers google",
            "anchor",
            "analyse headers",
            "contenttype",
            "transferenco",
            "connection",
            "date fri",
            "server",
            "read c",
            "as16509",
            "rgba",
            "unicode",
            "execution",
            "dock",
            "write",
            "persistence",
            "jsvendor",
            "jsapp",
            "script script",
            "cssapp",
            "jsfirebase",
            "moved",
            "urls",
            "pegasus",
            "encrypt",
            "script urls",
            "record value",
            "tls handshake",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "next",
            "capture",
            "malware",
            "unknown",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "access att",
            "t1189 driveby",
            "html",
            "mitre att",
            "ck matrix",
            "ascii text",
            "pattern match",
            "et info",
            "bad traffic",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "adversaries",
            "execution att",
            "t1204 user",
            "t1480 execution",
            "null",
            "refresh",
            "span",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "timothy",
            "search",
            "tag manager",
            "g8t6ln06z40",
            "code",
            "css",
            "js",
            "router",
            "cloudfront",
            "John 12:17",
            "port",
            "yara rule",
            "high",
            "tofsee",
            "rndhex",
            "rndchar",
            "destination",
            "loaderid",
            "lidfileupd",
            "stream"
          ],
          "references": [
            "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV",
            "https://pegasus.pahamify.com/",
            "aptia.palantirfoundry.com \u2022 palantirfoundry.com \u2022\u2019agent-infra-mojito.palantirfoundry.com",
            "equilibrium.palantirfoundry.com \u2022 kt-presales.palantirfoundry.com  \u2022 paloma.palantirfoundry.com",
            "usw-2-dev.palantirfoundry.com \u2022 lucyw.palantirfoundry.com \u2022 https://fegdip.palantirfoundry.com/",
            "http://dasima-containers.palantirfoundry.com/ \u2022 https://glare.palantirfoundry.com/",
            "https://inbound-message-listener-temporary-testing.palantirfoundry.com",
            "https://listeners.usw-16.palantirfoundry.com \u2022 https://pacificlife.palantirfoundry.com/",
            "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master",
            "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.afa33b71-01ea-477c-bc01-f6a3ab623e9d/master",
            "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master",
            "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
            "https://uhsinc.palantirfoundry.com/  \u2022 https://velocityglobal.palantirfoundry.com",
            "https://wes.palantirfoundry.com/ \u2022 http://utilities-bootcamp.palantirfoundry.com/",
            "http://glare.palantirfoundry.com/ \u2022 https://woodward.palantirfoundry.com/",
            "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
            "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd45176426a",
            "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd458176426a",
            "https://pegasus.pahamify.com/ \u2022 https://pegasus.pahamify.com/study-plan/ \u2022 pegasus.pahamify.com",
            "John 12:17"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Bible Gateway",
              "display_name": "Bible Gateway",
              "target": null
            },
            {
              "id": "Pahamify Pegasus",
              "display_name": "Pahamify Pegasus",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1608.004",
              "name": "Drive-by Target",
              "display_name": "T1608.004 - Drive-by Target"
            },
            {
              "id": "T1608.005",
              "name": "Link Target",
              "display_name": "T1608.005 - Link Target"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1192",
              "name": "Spearphishing Link",
              "display_name": "T1192 - Spearphishing Link"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6527,
            "hostname": 2450,
            "FileHash-SHA256": 1716,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 134,
            "domain": 1101,
            "email": 3,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 12184,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "111 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f9288e0d98f3b44c2cb90c",
          "name": "Ultrasounds attack - South African criminal group-Denver, Vo affects critical infrastructure , Oil and public safety",
          "description": "South African and Ethiopian crime group with Denver , Co  presence is not only infiltrating infrastructure from banking to oil, they are human traffickers, hitmen and yes, I received this tip from team member Pheona who a \u2018sassa.gov.za\u2018 South African link recurrently as a top search suggestion in a \u2018targets\u2019  browser. The most frightening piece is that a name listed is of an Ethiopian man who attempted to force a very targeted victim to go somewhere with him,, be his girlfriend and did show up outside of her residence in a different City & County. He also knew the exact name of where she purchased specific items. If you can see this. Please help the best way you can. Something is incredibly wrong. [OTX auto populated Title: We can\u2019t rely on goodwill to protect our critical infrastructure - Help Net Security]",
          "modified": "2025-11-21T18:02:11.054000",
          "created": "2025-10-22T18:55:10.527000",
          "tags": [
            "server nginx",
            "date fri",
            "etag w",
            "urls",
            "passive dns",
            "acceptranges",
            "contentlength",
            "date thu",
            "gmt expires",
            "server",
            "code",
            "link",
            "script script",
            "south africa",
            "ipv4",
            "files",
            "location south",
            "accept",
            "present aug",
            "certificate",
            "hostname add",
            "domain",
            "files ip",
            "unknown a",
            "script urls",
            "ip address",
            "unknown soa",
            "unknown ns",
            "reverse dns",
            "africa flag",
            "asn as16637",
            "dns resolutions",
            "domains top",
            "level",
            "unique tld",
            "related pulses",
            "tags none",
            "indicator facts",
            "title",
            "ipv4 add",
            "opinion",
            "netacea",
            "lockbit",
            "wannacry attack",
            "nhs trusts",
            "council",
            "uk government",
            "protect",
            "cni safe",
            "acls",
            "praio",
            "prink",
            "prsc",
            "prla",
            "lg2en",
            "cti98",
            "search",
            "seiko epson",
            "corporation",
            "arc file",
            "malware",
            "delete c",
            "default",
            "show",
            "write",
            "next",
            "unknown",
            "united",
            "tlsv1",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "as15169",
            "port",
            "execution",
            "dock",
            "capture",
            "persistence",
            "yara detections",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "low risk",
            "cabinet archive",
            "microsoft",
            "read c",
            "dynamicloader",
            "medium",
            "ltda me",
            "high",
            "write c",
            "entries",
            "checks",
            "delphi",
            "win32",
            "url pulse",
            "data upload",
            "extraction",
            "find suggested",
            "type",
            "domain hostname",
            "url add",
            "http",
            "related nids",
            "files location",
            "ireland flag",
            "files domain",
            "chrome",
            "ireland unknown",
            "pulse submit",
            "url analysis",
            "body",
            "date",
            "status",
            "name servers",
            "creation date",
            "expiration date",
            "flag united",
            "destination",
            "systemdrive",
            "html document",
            "crlf line",
            "updater",
            "copy",
            "unknown aaaa",
            "moved",
            "domain add",
            "extri data",
            "enter sc",
            "extr include",
            "review exclude",
            "sugges",
            "present jul",
            "saudi arabia",
            "present mar",
            "present oct",
            "present jun",
            "present feb",
            "present nov",
            "present may",
            "eeee",
            "eeeeeee",
            "eeeeee",
            "eefe",
            "ebeee",
            "ee eme",
            "eeheee",
            "eeefee e",
            "eeeee e",
            "vmprotect",
            "push",
            "local",
            "defender",
            "regsetvalueexa",
            "utf8 unicode"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lockbit",
              "display_name": "Lockbit",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "target": null
            },
            {
              "id": "Other Dangerous Malware",
              "display_name": "Other Dangerous Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1561",
              "name": "Disk Wipe",
              "display_name": "T1561 - Disk Wipe"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [
            "Oil"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 648,
            "hostname": 1604,
            "FileHash-SHA256": 1826,
            "URL": 4153,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 60,
            "SSLCertFingerprint": 18,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 8418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "190 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f93b1cebf80f48450bd517",
          "name": "Yuner - File deletion and Disk Wiping / Cyberstalking ",
          "description": "",
          "modified": "2025-11-21T18:02:11.054000",
          "created": "2025-10-22T20:14:20.632000",
          "tags": [
            "server nginx",
            "date fri",
            "etag w",
            "urls",
            "passive dns",
            "acceptranges",
            "contentlength",
            "date thu",
            "gmt expires",
            "server",
            "code",
            "link",
            "script script",
            "south africa",
            "ipv4",
            "files",
            "location south",
            "accept",
            "present aug",
            "certificate",
            "hostname add",
            "domain",
            "files ip",
            "unknown a",
            "script urls",
            "ip address",
            "unknown soa",
            "unknown ns",
            "reverse dns",
            "africa flag",
            "asn as16637",
            "dns resolutions",
            "domains top",
            "level",
            "unique tld",
            "related pulses",
            "tags none",
            "indicator facts",
            "title",
            "ipv4 add",
            "opinion",
            "netacea",
            "lockbit",
            "wannacry attack",
            "nhs trusts",
            "council",
            "uk government",
            "protect",
            "cni safe",
            "acls",
            "praio",
            "prink",
            "prsc",
            "prla",
            "lg2en",
            "cti98",
            "search",
            "seiko epson",
            "corporation",
            "arc file",
            "malware",
            "delete c",
            "default",
            "show",
            "write",
            "next",
            "unknown",
            "united",
            "tlsv1",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "as15169",
            "port",
            "execution",
            "dock",
            "capture",
            "persistence",
            "yara detections",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "low risk",
            "cabinet archive",
            "microsoft",
            "read c",
            "dynamicloader",
            "medium",
            "ltda me",
            "high",
            "write c",
            "entries",
            "checks",
            "delphi",
            "win32",
            "url pulse",
            "data upload",
            "extraction",
            "find suggested",
            "type",
            "domain hostname",
            "url add",
            "http",
            "related nids",
            "files location",
            "ireland flag",
            "files domain",
            "chrome",
            "ireland unknown",
            "pulse submit",
            "url analysis",
            "body",
            "date",
            "status",
            "name servers",
            "creation date",
            "expiration date",
            "flag united",
            "destination",
            "systemdrive",
            "html document",
            "crlf line",
            "updater",
            "copy",
            "unknown aaaa",
            "moved",
            "domain add",
            "extri data",
            "enter sc",
            "extr include",
            "review exclude",
            "sugges",
            "present jul",
            "saudi arabia",
            "present mar",
            "present oct",
            "present jun",
            "present feb",
            "present nov",
            "present may",
            "eeee",
            "eeeeeee",
            "eeeeee",
            "eefe",
            "ebeee",
            "ee eme",
            "eeheee",
            "eeefee e",
            "eeeee e",
            "vmprotect",
            "push",
            "local",
            "defender",
            "regsetvalueexa",
            "utf8 unicode"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lockbit",
              "display_name": "Lockbit",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
              "target": null
            },
            {
              "id": "Other Dangerous Malware",
              "display_name": "Other Dangerous Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1561",
              "name": "Disk Wipe",
              "display_name": "T1561 - Disk Wipe"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [
            "Oil"
          ],
          "TLP": "green",
          "cloned_from": "68f9288e0d98f3b44c2cb90c",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 648,
            "hostname": 1604,
            "FileHash-SHA256": 1826,
            "URL": 4153,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 60,
            "SSLCertFingerprint": 18,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 8418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "190 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://uhsinc.palantirfoundry.com/  \u2022 https://velocityglobal.palantirfoundry.com",
        "https://wes.palantirfoundry.com/ \u2022 http://utilities-bootcamp.palantirfoundry.com/",
        "usw-2-dev.palantirfoundry.com \u2022 lucyw.palantirfoundry.com \u2022 https://fegdip.palantirfoundry.com/",
        "http://dasima-containers.palantirfoundry.com/ \u2022 https://glare.palantirfoundry.com/",
        "https://listeners.usw-16.palantirfoundry.com \u2022 https://pacificlife.palantirfoundry.com/",
        "aptia.palantirfoundry.com \u2022 palantirfoundry.com \u2022\u2019agent-infra-mojito.palantirfoundry.com",
        "http://glare.palantirfoundry.com/ \u2022 https://woodward.palantirfoundry.com/",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.afa33b71-01ea-477c-bc01-f6a3ab623e9d/master",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd458176426a",
        "https://pegasus.pahamify.com/",
        "John 12:17",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master",
        "equilibrium.palantirfoundry.com \u2022 kt-presales.palantirfoundry.com  \u2022 paloma.palantirfoundry.com",
        "https://pegasus.pahamify.com/ \u2022 https://pegasus.pahamify.com/study-plan/ \u2022 pegasus.pahamify.com",
        "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
        "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd45176426a",
        "https://inbound-message-listener-temporary-testing.palantirfoundry.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Alf:heraklezeval:pua:win32/ultradownloads",
            "Other dangerous malware",
            "Pahamify pegasus",
            "Lockbit",
            "Et",
            "Bible gateway",
            "Tofsee"
          ],
          "industries": [
            "Oil"
          ],
          "unique_indicators": 20431
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/glance.com",
    "whois": "http://whois.domaintools.com/glance.com",
    "domain": "glance.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69612a0df518040b20932bef",
      "name": "Pahamify Pegasus | Palantir Malicious delivery via Bible app downloaded from iOS App Store",
      "description": "Pahamify Pegasus | Requires much further research.\nWorking backwards: Targeted device had a Bible Gateway app download by target from both iOS and Android devices. As per report each time app was accessed, iOS became glitched, passwords stolen, drive by compromise on lock screen prompted target to review app. She found the app login was changed to an unknown users name. I tested a (Bible Gateway) URI to see if her belief BG was a honey pot was true. \nThis may take 2-3 more rounds of research. \nIs Pegasus. Is Palantir. Is intrusive and malicious.\n\n[OTC auto generated Title: 2 Timothy 3 NIV - But mark this: There will be terrible - Bible Gateway]",
      "modified": "2026-02-08T15:00:50.749000",
      "created": "2026-01-09T16:17:17.632000",
      "tags": [
        "defense evasion",
        "cor ta0011",
        "techni process",
        "application l",
        "encrypted ch",
        "christ jesus",
        "just",
        "final charge",
        "timothy10",
        "antioch",
        "iconium",
        "lystra",
        "lord",
        "holy scriptures",
        "scripture",
        "bible gateway",
        "no expiration",
        "expiration",
        "a domains",
        "present sep",
        "united",
        "present jun",
        "meta",
        "present oct",
        "present aug",
        "servers",
        "title",
        "data upload",
        "extraction",
        "palantir foundry",
        "listeners",
        "dev",
        "redirects",
        "redirect health",
        "health data",
        "utc google",
        "utc na",
        "script",
        "utc amazon",
        "bible",
        "meta tags",
        "read",
        "bible reading",
        "trackers google",
        "anchor",
        "analyse headers",
        "contenttype",
        "transferenco",
        "connection",
        "date fri",
        "server",
        "read c",
        "as16509",
        "rgba",
        "unicode",
        "execution",
        "dock",
        "write",
        "persistence",
        "jsvendor",
        "jsapp",
        "script script",
        "cssapp",
        "jsfirebase",
        "moved",
        "urls",
        "pegasus",
        "encrypt",
        "script urls",
        "record value",
        "tls handshake",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "next",
        "capture",
        "malware",
        "unknown",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "access att",
        "t1189 driveby",
        "html",
        "mitre att",
        "ck matrix",
        "ascii text",
        "pattern match",
        "et info",
        "bad traffic",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "adversaries",
        "execution att",
        "t1204 user",
        "t1480 execution",
        "null",
        "refresh",
        "span",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "timothy",
        "search",
        "tag manager",
        "g8t6ln06z40",
        "code",
        "css",
        "js",
        "router",
        "cloudfront",
        "John 12:17",
        "port",
        "yara rule",
        "high",
        "tofsee",
        "rndhex",
        "rndchar",
        "destination",
        "loaderid",
        "lidfileupd",
        "stream"
      ],
      "references": [
        "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV",
        "https://pegasus.pahamify.com/",
        "aptia.palantirfoundry.com \u2022 palantirfoundry.com \u2022\u2019agent-infra-mojito.palantirfoundry.com",
        "equilibrium.palantirfoundry.com \u2022 kt-presales.palantirfoundry.com  \u2022 paloma.palantirfoundry.com",
        "usw-2-dev.palantirfoundry.com \u2022 lucyw.palantirfoundry.com \u2022 https://fegdip.palantirfoundry.com/",
        "http://dasima-containers.palantirfoundry.com/ \u2022 https://glare.palantirfoundry.com/",
        "https://inbound-message-listener-temporary-testing.palantirfoundry.com",
        "https://listeners.usw-16.palantirfoundry.com \u2022 https://pacificlife.palantirfoundry.com/",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.afa33b71-01ea-477c-bc01-f6a3ab623e9d/master",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master",
        "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
        "https://uhsinc.palantirfoundry.com/  \u2022 https://velocityglobal.palantirfoundry.com",
        "https://wes.palantirfoundry.com/ \u2022 http://utilities-bootcamp.palantirfoundry.com/",
        "http://glare.palantirfoundry.com/ \u2022 https://woodward.palantirfoundry.com/",
        "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd45176426a",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd458176426a",
        "https://pegasus.pahamify.com/ \u2022 https://pegasus.pahamify.com/study-plan/ \u2022 pegasus.pahamify.com",
        "John 12:17"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Bible Gateway",
          "display_name": "Bible Gateway",
          "target": null
        },
        {
          "id": "Pahamify Pegasus",
          "display_name": "Pahamify Pegasus",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1608.004",
          "name": "Drive-by Target",
          "display_name": "T1608.004 - Drive-by Target"
        },
        {
          "id": "T1608.005",
          "name": "Link Target",
          "display_name": "T1608.005 - Link Target"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1192",
          "name": "Spearphishing Link",
          "display_name": "T1192 - Spearphishing Link"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6527,
        "hostname": 2450,
        "FileHash-SHA256": 1716,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 134,
        "domain": 1101,
        "email": 3,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 12184,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "111 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f9288e0d98f3b44c2cb90c",
      "name": "Ultrasounds attack - South African criminal group-Denver, Vo affects critical infrastructure , Oil and public safety",
      "description": "South African and Ethiopian crime group with Denver , Co  presence is not only infiltrating infrastructure from banking to oil, they are human traffickers, hitmen and yes, I received this tip from team member Pheona who a \u2018sassa.gov.za\u2018 South African link recurrently as a top search suggestion in a \u2018targets\u2019  browser. The most frightening piece is that a name listed is of an Ethiopian man who attempted to force a very targeted victim to go somewhere with him,, be his girlfriend and did show up outside of her residence in a different City & County. He also knew the exact name of where she purchased specific items. If you can see this. Please help the best way you can. Something is incredibly wrong. [OTX auto populated Title: We can\u2019t rely on goodwill to protect our critical infrastructure - Help Net Security]",
      "modified": "2025-11-21T18:02:11.054000",
      "created": "2025-10-22T18:55:10.527000",
      "tags": [
        "server nginx",
        "date fri",
        "etag w",
        "urls",
        "passive dns",
        "acceptranges",
        "contentlength",
        "date thu",
        "gmt expires",
        "server",
        "code",
        "link",
        "script script",
        "south africa",
        "ipv4",
        "files",
        "location south",
        "accept",
        "present aug",
        "certificate",
        "hostname add",
        "domain",
        "files ip",
        "unknown a",
        "script urls",
        "ip address",
        "unknown soa",
        "unknown ns",
        "reverse dns",
        "africa flag",
        "asn as16637",
        "dns resolutions",
        "domains top",
        "level",
        "unique tld",
        "related pulses",
        "tags none",
        "indicator facts",
        "title",
        "ipv4 add",
        "opinion",
        "netacea",
        "lockbit",
        "wannacry attack",
        "nhs trusts",
        "council",
        "uk government",
        "protect",
        "cni safe",
        "acls",
        "praio",
        "prink",
        "prsc",
        "prla",
        "lg2en",
        "cti98",
        "search",
        "seiko epson",
        "corporation",
        "arc file",
        "malware",
        "delete c",
        "default",
        "show",
        "write",
        "next",
        "unknown",
        "united",
        "tlsv1",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "as15169",
        "port",
        "execution",
        "dock",
        "capture",
        "persistence",
        "yara detections",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "low risk",
        "cabinet archive",
        "microsoft",
        "read c",
        "dynamicloader",
        "medium",
        "ltda me",
        "high",
        "write c",
        "entries",
        "checks",
        "delphi",
        "win32",
        "url pulse",
        "data upload",
        "extraction",
        "find suggested",
        "type",
        "domain hostname",
        "url add",
        "http",
        "related nids",
        "files location",
        "ireland flag",
        "files domain",
        "chrome",
        "ireland unknown",
        "pulse submit",
        "url analysis",
        "body",
        "date",
        "status",
        "name servers",
        "creation date",
        "expiration date",
        "flag united",
        "destination",
        "systemdrive",
        "html document",
        "crlf line",
        "updater",
        "copy",
        "unknown aaaa",
        "moved",
        "domain add",
        "extri data",
        "enter sc",
        "extr include",
        "review exclude",
        "sugges",
        "present jul",
        "saudi arabia",
        "present mar",
        "present oct",
        "present jun",
        "present feb",
        "present nov",
        "present may",
        "eeee",
        "eeeeeee",
        "eeeeee",
        "eefe",
        "ebeee",
        "ee eme",
        "eeheee",
        "eeefee e",
        "eeeee e",
        "vmprotect",
        "push",
        "local",
        "defender",
        "regsetvalueexa",
        "utf8 unicode"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lockbit",
          "display_name": "Lockbit",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "target": null
        },
        {
          "id": "Other Dangerous Malware",
          "display_name": "Other Dangerous Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1561",
          "name": "Disk Wipe",
          "display_name": "T1561 - Disk Wipe"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [
        "Oil"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 648,
        "hostname": 1604,
        "FileHash-SHA256": 1826,
        "URL": 4153,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 60,
        "SSLCertFingerprint": 18,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 8418,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "190 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f93b1cebf80f48450bd517",
      "name": "Yuner - File deletion and Disk Wiping / Cyberstalking ",
      "description": "",
      "modified": "2025-11-21T18:02:11.054000",
      "created": "2025-10-22T20:14:20.632000",
      "tags": [
        "server nginx",
        "date fri",
        "etag w",
        "urls",
        "passive dns",
        "acceptranges",
        "contentlength",
        "date thu",
        "gmt expires",
        "server",
        "code",
        "link",
        "script script",
        "south africa",
        "ipv4",
        "files",
        "location south",
        "accept",
        "present aug",
        "certificate",
        "hostname add",
        "domain",
        "files ip",
        "unknown a",
        "script urls",
        "ip address",
        "unknown soa",
        "unknown ns",
        "reverse dns",
        "africa flag",
        "asn as16637",
        "dns resolutions",
        "domains top",
        "level",
        "unique tld",
        "related pulses",
        "tags none",
        "indicator facts",
        "title",
        "ipv4 add",
        "opinion",
        "netacea",
        "lockbit",
        "wannacry attack",
        "nhs trusts",
        "council",
        "uk government",
        "protect",
        "cni safe",
        "acls",
        "praio",
        "prink",
        "prsc",
        "prla",
        "lg2en",
        "cti98",
        "search",
        "seiko epson",
        "corporation",
        "arc file",
        "malware",
        "delete c",
        "default",
        "show",
        "write",
        "next",
        "unknown",
        "united",
        "tlsv1",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "as15169",
        "port",
        "execution",
        "dock",
        "capture",
        "persistence",
        "yara detections",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "low risk",
        "cabinet archive",
        "microsoft",
        "read c",
        "dynamicloader",
        "medium",
        "ltda me",
        "high",
        "write c",
        "entries",
        "checks",
        "delphi",
        "win32",
        "url pulse",
        "data upload",
        "extraction",
        "find suggested",
        "type",
        "domain hostname",
        "url add",
        "http",
        "related nids",
        "files location",
        "ireland flag",
        "files domain",
        "chrome",
        "ireland unknown",
        "pulse submit",
        "url analysis",
        "body",
        "date",
        "status",
        "name servers",
        "creation date",
        "expiration date",
        "flag united",
        "destination",
        "systemdrive",
        "html document",
        "crlf line",
        "updater",
        "copy",
        "unknown aaaa",
        "moved",
        "domain add",
        "extri data",
        "enter sc",
        "extr include",
        "review exclude",
        "sugges",
        "present jul",
        "saudi arabia",
        "present mar",
        "present oct",
        "present jun",
        "present feb",
        "present nov",
        "present may",
        "eeee",
        "eeeeeee",
        "eeeeee",
        "eefe",
        "ebeee",
        "ee eme",
        "eeheee",
        "eeefee e",
        "eeeee e",
        "vmprotect",
        "push",
        "local",
        "defender",
        "regsetvalueexa",
        "utf8 unicode"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lockbit",
          "display_name": "Lockbit",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "display_name": "ALF:HeraklezEval:PUA:Win32/UltraDownloads",
          "target": null
        },
        {
          "id": "Other Dangerous Malware",
          "display_name": "Other Dangerous Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1561",
          "name": "Disk Wipe",
          "display_name": "T1561 - Disk Wipe"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [
        "Oil"
      ],
      "TLP": "green",
      "cloned_from": "68f9288e0d98f3b44c2cb90c",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 648,
        "hostname": 1604,
        "FileHash-SHA256": 1826,
        "URL": 4153,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 60,
        "SSLCertFingerprint": 18,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 8418,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "190 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://glance.com/us/about-us",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://glance.com/us/about-us",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780237250.4749758
}