{
  "type": "URL",
  "indicator": "https://help.albacross.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://help.albacross.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3875192701,
      "indicator": "https://help.albacross.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69560fa62bddc3d965359168",
          "name": "Mirai H5DATACENTERS.COM \u2022 Regis University Blackout  | Extranet",
          "description": "It was Data Center 5. \nH5DATACENTERS.COM \u2022 Regis University Blackout PrometheusIntelligenceTechnology.com - Extranet.  Forced out of RU for finding malicious link that targeted , tracked ,conversations , behavior, etc.,  \u201cNo one willingly signed up to be tracked.\u201dis what Tsara told Dean Archer. He said he\u2019d never seen anything like this in his life. RU ignored the risks Tsara cautioned could irreparably damage incoming students college experience and negatively impact their future. I just hope the many students who attended do not continue to suffer. Guess who the villain was? The truth teller. \n\nToday activity has stepped up. Somehow the PIT Pulse has caused a crusade of aggressive following and investigation. \n\nThere may be 10,000 vs 1 in this battle. But the One is God.",
          "modified": "2026-01-31T03:04:09.490000",
          "created": "2026-01-01T06:09:42.057000",
          "tags": [
            "http",
            "files related",
            "related tags",
            "ipv4",
            "ccus asnas20029",
            "urls",
            "domain",
            "files ip",
            "address domain",
            "ip whois",
            "passive dns",
            "gmt path",
            "hostname add",
            "files",
            "united",
            "a li",
            "trackingpin a",
            "ip address",
            "unknown aaaa",
            "error",
            "back",
            "darkness",
            "present sep",
            "a domains",
            "script urls",
            "unknown ns",
            "script domains",
            "meta",
            "apache",
            "body doctype",
            "gmt server",
            "url analysis",
            "path",
            "accept",
            "pragma",
            "west domains",
            "present dec",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "data upload",
            "extraction",
            "found",
            "datacenter",
            "hosting",
            "vps reverse",
            "america united",
            "america asn",
            "as398101",
            "body html",
            "head title",
            "title",
            "status",
            "name servers",
            "failed",
            "all se",
            "enter sc",
            "type",
            "extra data",
            "referen",
            "manualv add",
            "indicator data",
            "port",
            "destination",
            "south korea",
            "china as4134",
            "taiwan as3462",
            "as3786 lg",
            "as4766 korea",
            "as9318 sk",
            "high",
            "tcp syn",
            "trojan",
            "pegasus",
            "malware",
            "unknown",
            "search",
            "present jan",
            "pur sta",
            "uni idc",
            "cao oti",
            "dsp cor",
            "body",
            "win32",
            "united states",
            "pulse tags",
            "palantir",
            "ad maven",
            "technology",
            "url https",
            "url http",
            "indicator role",
            "title added",
            "active related",
            "Palantir",
            "Ad-Maven",
            "Palantir",
            "Ad- Maven",
            "Prometheus Intelligence Technology",
            "skynet",
            "starfield tech",
            "flock",
            "report spam",
            "palantir ad",
            "maven",
            "botnet",
            "created",
            "days ago",
            "education",
            "tsara",
            "mirai",
            "regis",
            "brashears",
            "discovery",
            "universities",
            "tsara brashears",
            "close",
            "stop",
            "ransom",
            "capture",
            "denver"
          ],
          "references": [
            "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM",
            "https://prometheusintelligencetechnology.com/pit/",
            "https://prometheusintelligencetechnology.com/404javascript.js",
            "https://www.secureserver.net/default404.aspx",
            "http://ocsp.starfieldtech.com/ 443 Certificate",
            "https://www.secureserver.net/default404.aspx  Server: Microsoft-IIS/7.0",
            "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/  P3P:",
            "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"",
            "Powered-By: ARR/2.5  X-Powered-By: ASP.NET",
            "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found  Content-Length: 161",
            "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM   X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM",
            "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"",
            "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )",
            "Certificate Crldistributionpoints",
            "http://crl.starfieldtech.com/sfig2s2-0.crl 443",
            "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net",
            "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers",
            "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443",
            "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443",
            "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443",
            "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer",
            "http://certs.starfieldtech.com/repository/ 443",
            "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443",
            "A Domains \u2022 www.secureserver.net 443 Certificate",
            "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx",
            "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found  Cache-Control: private",
            "Content-Length: 160  Location: http://www.secureserver.net/default404.aspx",
            "Server: Microsoft-IIS/7.0  Set-Cookie: market=en-US; domain=secureserver.net;",
            "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/  P3P: policyref=\"/w3c/p3p.xml\",",
            "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"",
            "X-Powered-By: ARR/2.5  X-Powered-By: ASP.NET  P3P: policyref=\"/w3c/p3p.xml\", CP=\"",
            "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"",
            "Date: Tue, 13 Jun 2017 10:21:34 GMT",
            "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc",
            "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org",
            "PDNS11.DOMAINCONTROL.COM",
            "https://otx.alienvault.com/indicator/domain/secureserver.net",
            "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf",
            "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication",
            "https://den.h5datacenters.com/",
            "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer",
            "register.blackgirldroneworld.com (Is this racist)",
            "https://stetsed.xyz/apple",
            "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology",
            "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co",
            "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD",
            "Patient/ Victim unaware of her workers compensation rights.",
            "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!",
            "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey",
            "I haven\u2019t mentioned the hit men they hired.",
            "Fastly.com",
            "www.skynetsoftware.com",
            "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android&reg=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t",
            "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t",
            "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox",
            "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Virus:Win32/Triusor.A",
              "display_name": "Virus:Win32/Triusor.A",
              "target": "/malware/Virus:Win32/Triusor.A"
            },
            {
              "id": "!InstallCreatorPro_2_0",
              "display_name": "!InstallCreatorPro_2_0",
              "target": null
            },
            {
              "id": "Unix.Trojan.Mirai-7640640-0",
              "display_name": "Unix.Trojan.Mirai-7640640-0",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "Win.Downloader",
              "display_name": "Win.Downloader",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [
            "Education",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2817,
            "domain": 487,
            "hostname": 983,
            "FileHash-SHA256": 611,
            "FileHash-MD5": 107,
            "FileHash-SHA1": 106,
            "email": 2
          },
          "indicator_count": 5113,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "78 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695043197c2fbfda85abc1d4",
          "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
          "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
          "modified": "2025-12-27T20:35:37.012000",
          "created": "2025-12-27T20:35:37.012000",
          "tags": [
            "Palantir",
            "Ad- Maven",
            "Prometheus Intelligence Technology"
          ],
          "references": [
            "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
            "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Carts.Guru",
              "display_name": "Carts.Guru",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Government",
            "Education",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 82,
            "hostname": 180,
            "URL": 995,
            "FileHash-SHA256": 110
          },
          "indicator_count": 1367,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "112 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d91b1a8f414040bfba430",
          "name": "Spyware",
          "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
          "modified": "2025-08-20T00:01:59.498000",
          "created": "2025-07-21T01:02:41.049000",
          "tags": [
            "serving ip",
            "address",
            "status",
            "utc na",
            "utc google",
            "utc facebook",
            "custom audience",
            "tag manager",
            "ua748443502",
            "utc gtmwrp73mt",
            "utc gsrdlm5jnx1",
            "utc aw937838002",
            "adsense na",
            "connect",
            "file type",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "powershell",
            "b file",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "c0002 wininet",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cndigicert sha2",
            "secure server",
            "ca odigicert",
            "inc cus",
            "subject",
            "cnwe1 ogoogle",
            "trust",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft",
            "get http",
            "request",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "response",
            "united",
            "search",
            "creation date",
            "expiration date",
            "name servers",
            "unknown soa",
            "germany unknown",
            "entries",
            "pulse submit",
            "url analysis",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 304,
            "hostname": 796,
            "URL": 2590,
            "FileHash-SHA256": 2735,
            "FileHash-MD5": 253,
            "FileHash-SHA1": 144,
            "email": 1
          },
          "indicator_count": 6823,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66536881127f5ee988306394",
          "name": "iOS Attack - Crouching Yeti: http://x.com/denverpolice/status/|",
          "description": "Targeted triangulation. Apple iOS iPad. Attack chains of Operation Triangulation involves advanced tactics employed by those acting as secret middleman, deploying spoofed trusted websites, emails, alarming news stories, messages, Bluetooth hacking, if threat actor has full CnC of targets phone via injection (sometimes it's random) can power on B/T.   In Spoofed sites, malicious redirects, iMessage 0day case. Zero-click iMessage exploit seen. Information is sent to attacker and stored. Data harvesting, financial & identity theft, service modification and DoS intended. Used by law enforcement, governments, attorney PI's, cyber security defense, red teams and/or malicious hackers.\n*Crouching Yeti threat description notes: Contextual Indicators: Domain is classified as Social Networking Contextual Indicators: The URL is known benign by Check Point's Threat Cloud Contextual Indicators: Https://x.com is popular among websites with good reputation Contextual Indicators: Domain Cisco Umbrella rank is 312.",
          "modified": "2024-06-25T16:05:26.604000",
          "created": "2024-05-26T16:51:13.962000",
          "tags": [
            "sha256",
            "sha1",
            "pattern match",
            "ascii text",
            "document file",
            "v2 document",
            "crlf line",
            "size",
            "unicode",
            "beginstring",
            "null",
            "hybrid",
            "refresh",
            "body",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "external-resources",
            "dom-modification",
            "third-party-cookies",
            "iframes",
            "trackers",
            "text/html",
            "twitter",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "headers",
            "deny",
            "express",
            "referrer",
            "impacting azure",
            "proofpoint",
            "sneaky server",
            "replacement",
            "unauthorized",
            "switch dns",
            "query",
            "vy binh",
            "hiddentear",
            "et tor",
            "known tor",
            "misc attack",
            "relayrouter",
            "exit",
            "node traffic",
            "date",
            "meta",
            "form",
            "submission",
            "expiresthu",
            "path",
            "secure",
            "self",
            "xcitium verdict",
            "cloud",
            "sophos",
            "history first",
            "analysis",
            "cp",
            "cyber",
            "threat",
            "redrum",
            "hit",
            "men",
            "triangulation",
            "historical ssl",
            "apt suspects",
            "critical cmd",
            "hide",
            "asyncrat",
            "jeremy",
            "government",
            "malicious",
            "yuming",
            "name servers",
            "united",
            "passive dns",
            "urls",
            "creation date",
            "search",
            "expiration date",
            "showing",
            "unknown",
            "next",
            "windows nt",
            "malware beacon",
            "memcommit",
            "generic http",
            "exe upload",
            "outbound",
            "etpro trojan",
            "show",
            "trojan",
            "copy",
            "write",
            "win32",
            "malware",
            "read c",
            "entries",
            "medium",
            "markus",
            "contentlength",
            "write c",
            "delete c",
            "create c",
            "yara detections",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "next pe",
            "as32934",
            "hitmen",
            "local government",
            "scene unit",
            "crime",
            "denver police",
            "address",
            "status",
            "aaaa",
            "apple",
            "less whois",
            "registrar",
            "wannacry",
            "http",
            "unique",
            "url https",
            "related nids",
            "code",
            "screenshot",
            "anity",
            "nsa",
            "shadow",
            "saudi telecom",
            "riyadh address",
            "saudi arabia",
            "abuse",
            "ripe",
            "company isp",
            "number",
            "label saudi",
            "telecom company",
            "jsc regional",
            "riyadh",
            "ripe ncc",
            "registry techc",
            "campus",
            "saudi",
            "ripe network",
            "domain",
            "internet se",
            "emails",
            "system",
            "server tsa",
            "b server",
            "certificate",
            "digicert inc",
            "moved",
            "record value"
          ],
          "references": [
            "http://x.com/denverpolice/status/",
            "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX",
            "Redirects to https://twitter.com?mx=1",
            "IP address: 104.244.42.1  Hosting: Unknown  Running on: Tsa B  CMS: Express",
            "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence",
            "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e",
            "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx",
            "Alerts: packer_entropy packer_upx antivm_memory_available pe_features",
            "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX",
            "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]",
            "Yara Detections: ConventionEngine_Term_Desktop ,  LZMA ,  mpress_2_xx_x86 ,  dbgdetect_procs",
            "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/",
            "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4",
            "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e",
            "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717",
            "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com",
            "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show  100 entr",
            "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com",
            "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.",
            "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html",
            "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html",
            "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah,  Saudi Arabia ASN AS39891 saudi telecom company jsc",
            "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win32/Vflooder.B Checkin",
              "display_name": "Win32/Vflooder.B Checkin",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6723768-0",
              "display_name": "Win.Malware.Vtflooder-6723768-0",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Win32/Vflooder.B vtapi DOS",
              "display_name": "Win32/Vflooder.B vtapi DOS",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win.Trojan.Downloader-63174",
              "display_name": "Win.Trojan.Downloader-63174",
              "target": null
            },
            {
              "id": "Clicker.BGOU",
              "display_name": "Clicker.BGOU",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-752791",
              "display_name": "Win.Trojan.Agent-752791",
              "target": null
            },
            {
              "id": "Win.Dropper.QQpass-9895638-0",
              "display_name": "Win.Dropper.QQpass-9895638-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/QQpass",
              "display_name": "Trojan:Win32/QQpass",
              "target": "/malware/Trojan:Win32/QQpass"
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1038",
              "name": "DLL Search Order Hijacking",
              "display_name": "T1038 - DLL Search Order Hijacking"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1470",
              "name": "Obtain Device Cloud Backups",
              "display_name": "T1470 - Obtain Device Cloud Backups"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 48,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 350,
            "FileHash-SHA1": 348,
            "FileHash-SHA256": 2659,
            "URL": 7850,
            "domain": 2245,
            "hostname": 3611,
            "SSLCertFingerprint": 4,
            "email": 10,
            "CIDR": 4
          },
          "indicator_count": 17081,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "663 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66536c8eee8d42d670e27723",
          "name": "Eternal Blue _ WannaCry MS17-010  | Apple iOS iMessage injection infiltration",
          "description": "",
          "modified": "2024-06-25T16:05:26.604000",
          "created": "2024-05-26T17:08:30.022000",
          "tags": [
            "sha256",
            "sha1",
            "pattern match",
            "ascii text",
            "document file",
            "v2 document",
            "crlf line",
            "size",
            "unicode",
            "beginstring",
            "null",
            "hybrid",
            "refresh",
            "body",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "external-resources",
            "dom-modification",
            "third-party-cookies",
            "iframes",
            "trackers",
            "text/html",
            "twitter",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "headers",
            "deny",
            "express",
            "referrer",
            "impacting azure",
            "proofpoint",
            "sneaky server",
            "replacement",
            "unauthorized",
            "switch dns",
            "query",
            "vy binh",
            "hiddentear",
            "et tor",
            "known tor",
            "misc attack",
            "relayrouter",
            "exit",
            "node traffic",
            "date",
            "meta",
            "form",
            "submission",
            "expiresthu",
            "path",
            "secure",
            "self",
            "xcitium verdict",
            "cloud",
            "sophos",
            "history first",
            "analysis",
            "cp",
            "cyber",
            "threat",
            "redrum",
            "hit",
            "men",
            "triangulation",
            "historical ssl",
            "apt suspects",
            "critical cmd",
            "hide",
            "asyncrat",
            "jeremy",
            "government",
            "malicious",
            "yuming",
            "name servers",
            "united",
            "passive dns",
            "urls",
            "creation date",
            "search",
            "expiration date",
            "showing",
            "unknown",
            "next",
            "windows nt",
            "malware beacon",
            "memcommit",
            "generic http",
            "exe upload",
            "outbound",
            "etpro trojan",
            "show",
            "trojan",
            "copy",
            "write",
            "win32",
            "malware",
            "read c",
            "entries",
            "medium",
            "markus",
            "contentlength",
            "write c",
            "delete c",
            "create c",
            "yara detections",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "next pe",
            "as32934",
            "hitmen",
            "local government",
            "scene unit",
            "crime",
            "denver police",
            "address",
            "status",
            "aaaa",
            "apple",
            "less whois",
            "registrar",
            "wannacry",
            "http",
            "unique",
            "url https",
            "related nids",
            "code",
            "screenshot",
            "anity",
            "nsa",
            "shadow",
            "saudi telecom",
            "riyadh address",
            "saudi arabia",
            "abuse",
            "ripe",
            "company isp",
            "number",
            "label saudi",
            "telecom company",
            "jsc regional",
            "riyadh",
            "ripe ncc",
            "registry techc",
            "campus",
            "saudi",
            "ripe network",
            "domain",
            "internet se",
            "emails",
            "system",
            "server tsa",
            "b server",
            "certificate",
            "digicert inc",
            "moved",
            "record value"
          ],
          "references": [
            "http://x.com/denverpolice/status/",
            "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX",
            "Redirects to https://twitter.com?mx=1",
            "IP address: 104.244.42.1  Hosting: Unknown  Running on: Tsa B  CMS: Express",
            "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence",
            "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e",
            "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx",
            "Alerts: packer_entropy packer_upx antivm_memory_available pe_features",
            "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX",
            "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]",
            "Yara Detections: ConventionEngine_Term_Desktop ,  LZMA ,  mpress_2_xx_x86 ,  dbgdetect_procs",
            "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/",
            "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4",
            "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e",
            "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717",
            "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com",
            "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show  100 entr",
            "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com",
            "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.",
            "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html",
            "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html",
            "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah,  Saudi Arabia ASN AS39891 saudi telecom company jsc",
            "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win32/Vflooder.B Checkin",
              "display_name": "Win32/Vflooder.B Checkin",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6723768-0",
              "display_name": "Win.Malware.Vtflooder-6723768-0",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Win32/Vflooder.B vtapi DOS",
              "display_name": "Win32/Vflooder.B vtapi DOS",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win.Trojan.Downloader-63174",
              "display_name": "Win.Trojan.Downloader-63174",
              "target": null
            },
            {
              "id": "Clicker.BGOU",
              "display_name": "Clicker.BGOU",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-752791",
              "display_name": "Win.Trojan.Agent-752791",
              "target": null
            },
            {
              "id": "Win.Dropper.QQpass-9895638-0",
              "display_name": "Win.Dropper.QQpass-9895638-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/QQpass",
              "display_name": "Trojan:Win32/QQpass",
              "target": "/malware/Trojan:Win32/QQpass"
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1038",
              "name": "DLL Search Order Hijacking",
              "display_name": "T1038 - DLL Search Order Hijacking"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1470",
              "name": "Obtain Device Cloud Backups",
              "display_name": "T1470 - Obtain Device Cloud Backups"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66536881127f5ee988306394",
          "export_count": 55,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 350,
            "FileHash-SHA1": 348,
            "FileHash-SHA256": 2659,
            "URL": 7850,
            "domain": 2245,
            "hostname": 3611,
            "SSLCertFingerprint": 4,
            "email": 10,
            "CIDR": 4
          },
          "indicator_count": 17081,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "663 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com",
        "https://prometheusintelligencetechnology.com/pit/",
        "http://certs.starfieldtech.com/repository/ 443",
        "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found  Content-Length: 161",
        "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers",
        "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co",
        "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443",
        "https://prometheusintelligencetechnology.com/404javascript.js",
        "https://www.secureserver.net/default404.aspx",
        "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM   X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM",
        "http://crl.starfieldtech.com/sfig2s2-0.crl 443",
        "PDNS11.DOMAINCONTROL.COM",
        "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/  P3P: policyref=\"/w3c/p3p.xml\",",
        "https://otx.alienvault.com/indicator/domain/secureserver.net",
        "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html",
        "Alerts: packer_entropy packer_upx antivm_memory_available pe_features",
        "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/  P3P:",
        "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"",
        "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml",
        "Fastly.com",
        "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4",
        "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD",
        "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com",
        "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX",
        "register.blackgirldroneworld.com (Is this racist)",
        "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"",
        "Powered-By: ARR/2.5  X-Powered-By: ASP.NET",
        "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html",
        "I haven\u2019t mentioned the hit men they hired.",
        "www.skynetsoftware.com",
        "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t",
        "Certificate Crldistributionpoints",
        "Redirects to https://twitter.com?mx=1",
        "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM",
        "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )",
        "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!",
        "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"",
        "https://www.secureserver.net/default404.aspx  Server: Microsoft-IIS/7.0",
        "A Domains \u2022 www.secureserver.net 443 Certificate",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse",
        "IP address: 104.244.42.1  Hosting: Unknown  Running on: Tsa B  CMS: Express",
        "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx",
        "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443",
        "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf",
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"",
        "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net",
        "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org",
        "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication",
        "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer",
        "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx",
        "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e",
        "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443",
        "Date: Tue, 13 Jun 2017 10:21:34 GMT",
        "Content-Length: 160  Location: http://www.secureserver.net/default404.aspx",
        "Patient/ Victim unaware of her workers compensation rights.",
        "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android&reg=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t",
        "https://stetsed.xyz/apple",
        "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com",
        "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717",
        "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.",
        "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found  Cache-Control: private",
        "Server: Microsoft-IIS/7.0  Set-Cookie: market=en-US; domain=secureserver.net;",
        "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox",
        "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443",
        "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/",
        "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc",
        "Yara Detections: ConventionEngine_Term_Desktop ,  LZMA ,  mpress_2_xx_x86 ,  dbgdetect_procs",
        "X-Powered-By: ARR/2.5  X-Powered-By: ASP.NET  P3P: policyref=\"/w3c/p3p.xml\", CP=\"",
        "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX",
        "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]",
        "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah,  Saudi Arabia ASN AS39891 saudi telecom company jsc",
        "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show  100 entr",
        "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence",
        "http://ocsp.starfieldtech.com/ 443 Certificate",
        "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer",
        "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey",
        "http://x.com/denverpolice/status/",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e",
        "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology",
        "https://den.h5datacenters.com/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Unix.trojan.mirai-7640640-0",
            "Mirai",
            "Win32:trojan-gen",
            "Win.downloader",
            "Win.trojan.agent-752791",
            "Virus:win32/triusor.a",
            "Win.malware.vtflooder-6723768-0",
            "Clicker.bgou",
            "Win.trojan.downloader-63174",
            "Wannacry",
            "Carts.guru",
            "!installcreatorpro_2_0",
            "Win.dropper.qqpass-9895638-0",
            "#lowfienabledtcontinueafterunpacking",
            "Win32/vflooder.b checkin",
            "Win32/vflooder.b vtapi dos",
            "Trojan:win32/qqpass",
            "Win32:malware-gen"
          ],
          "industries": [
            "Government",
            "Civil society",
            "Education"
          ],
          "unique_indicators": 28404
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/albacross.com",
    "whois": "http://whois.domaintools.com/albacross.com",
    "domain": "albacross.com",
    "hostname": "help.albacross.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69560fa62bddc3d965359168",
      "name": "Mirai H5DATACENTERS.COM \u2022 Regis University Blackout  | Extranet",
      "description": "It was Data Center 5. \nH5DATACENTERS.COM \u2022 Regis University Blackout PrometheusIntelligenceTechnology.com - Extranet.  Forced out of RU for finding malicious link that targeted , tracked ,conversations , behavior, etc.,  \u201cNo one willingly signed up to be tracked.\u201dis what Tsara told Dean Archer. He said he\u2019d never seen anything like this in his life. RU ignored the risks Tsara cautioned could irreparably damage incoming students college experience and negatively impact their future. I just hope the many students who attended do not continue to suffer. Guess who the villain was? The truth teller. \n\nToday activity has stepped up. Somehow the PIT Pulse has caused a crusade of aggressive following and investigation. \n\nThere may be 10,000 vs 1 in this battle. But the One is God.",
      "modified": "2026-01-31T03:04:09.490000",
      "created": "2026-01-01T06:09:42.057000",
      "tags": [
        "http",
        "files related",
        "related tags",
        "ipv4",
        "ccus asnas20029",
        "urls",
        "domain",
        "files ip",
        "address domain",
        "ip whois",
        "passive dns",
        "gmt path",
        "hostname add",
        "files",
        "united",
        "a li",
        "trackingpin a",
        "ip address",
        "unknown aaaa",
        "error",
        "back",
        "darkness",
        "present sep",
        "a domains",
        "script urls",
        "unknown ns",
        "script domains",
        "meta",
        "apache",
        "body doctype",
        "gmt server",
        "url analysis",
        "path",
        "accept",
        "pragma",
        "west domains",
        "present dec",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "data upload",
        "extraction",
        "found",
        "datacenter",
        "hosting",
        "vps reverse",
        "america united",
        "america asn",
        "as398101",
        "body html",
        "head title",
        "title",
        "status",
        "name servers",
        "failed",
        "all se",
        "enter sc",
        "type",
        "extra data",
        "referen",
        "manualv add",
        "indicator data",
        "port",
        "destination",
        "south korea",
        "china as4134",
        "taiwan as3462",
        "as3786 lg",
        "as4766 korea",
        "as9318 sk",
        "high",
        "tcp syn",
        "trojan",
        "pegasus",
        "malware",
        "unknown",
        "search",
        "present jan",
        "pur sta",
        "uni idc",
        "cao oti",
        "dsp cor",
        "body",
        "win32",
        "united states",
        "pulse tags",
        "palantir",
        "ad maven",
        "technology",
        "url https",
        "url http",
        "indicator role",
        "title added",
        "active related",
        "Palantir",
        "Ad-Maven",
        "Palantir",
        "Ad- Maven",
        "Prometheus Intelligence Technology",
        "skynet",
        "starfield tech",
        "flock",
        "report spam",
        "palantir ad",
        "maven",
        "botnet",
        "created",
        "days ago",
        "education",
        "tsara",
        "mirai",
        "regis",
        "brashears",
        "discovery",
        "universities",
        "tsara brashears",
        "close",
        "stop",
        "ransom",
        "capture",
        "denver"
      ],
      "references": [
        "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM",
        "https://prometheusintelligencetechnology.com/pit/",
        "https://prometheusintelligencetechnology.com/404javascript.js",
        "https://www.secureserver.net/default404.aspx",
        "http://ocsp.starfieldtech.com/ 443 Certificate",
        "https://www.secureserver.net/default404.aspx  Server: Microsoft-IIS/7.0",
        "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/  P3P:",
        "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"",
        "Powered-By: ARR/2.5  X-Powered-By: ASP.NET",
        "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found  Content-Length: 161",
        "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM   X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM",
        "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"",
        "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )",
        "Certificate Crldistributionpoints",
        "http://crl.starfieldtech.com/sfig2s2-0.crl 443",
        "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net",
        "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers",
        "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443",
        "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443",
        "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443",
        "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer",
        "http://certs.starfieldtech.com/repository/ 443",
        "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443",
        "A Domains \u2022 www.secureserver.net 443 Certificate",
        "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx",
        "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found  Cache-Control: private",
        "Content-Length: 160  Location: http://www.secureserver.net/default404.aspx",
        "Server: Microsoft-IIS/7.0  Set-Cookie: market=en-US; domain=secureserver.net;",
        "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/  P3P: policyref=\"/w3c/p3p.xml\",",
        "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"",
        "X-Powered-By: ARR/2.5  X-Powered-By: ASP.NET  P3P: policyref=\"/w3c/p3p.xml\", CP=\"",
        "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"",
        "Date: Tue, 13 Jun 2017 10:21:34 GMT",
        "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc",
        "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org",
        "PDNS11.DOMAINCONTROL.COM",
        "https://otx.alienvault.com/indicator/domain/secureserver.net",
        "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf",
        "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication",
        "https://den.h5datacenters.com/",
        "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer",
        "register.blackgirldroneworld.com (Is this racist)",
        "https://stetsed.xyz/apple",
        "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology",
        "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co",
        "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD",
        "Patient/ Victim unaware of her workers compensation rights.",
        "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!",
        "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey",
        "I haven\u2019t mentioned the hit men they hired.",
        "Fastly.com",
        "www.skynetsoftware.com",
        "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android&reg=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t",
        "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t",
        "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox",
        "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Virus:Win32/Triusor.A",
          "display_name": "Virus:Win32/Triusor.A",
          "target": "/malware/Virus:Win32/Triusor.A"
        },
        {
          "id": "!InstallCreatorPro_2_0",
          "display_name": "!InstallCreatorPro_2_0",
          "target": null
        },
        {
          "id": "Unix.Trojan.Mirai-7640640-0",
          "display_name": "Unix.Trojan.Mirai-7640640-0",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "Win.Downloader",
          "display_name": "Win.Downloader",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [
        "Education",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2817,
        "domain": 487,
        "hostname": 983,
        "FileHash-SHA256": 611,
        "FileHash-MD5": 107,
        "FileHash-SHA1": 106,
        "email": 2
      },
      "indicator_count": 5113,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "78 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695043197c2fbfda85abc1d4",
      "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
      "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
      "modified": "2025-12-27T20:35:37.012000",
      "created": "2025-12-27T20:35:37.012000",
      "tags": [
        "Palantir",
        "Ad- Maven",
        "Prometheus Intelligence Technology"
      ],
      "references": [
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Carts.Guru",
          "display_name": "Carts.Guru",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Government",
        "Education",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 82,
        "hostname": 180,
        "URL": 995,
        "FileHash-SHA256": 110
      },
      "indicator_count": 1367,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "112 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d91b1a8f414040bfba430",
      "name": "Spyware",
      "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
      "modified": "2025-08-20T00:01:59.498000",
      "created": "2025-07-21T01:02:41.049000",
      "tags": [
        "serving ip",
        "address",
        "status",
        "utc na",
        "utc google",
        "utc facebook",
        "custom audience",
        "tag manager",
        "ua748443502",
        "utc gtmwrp73mt",
        "utc gsrdlm5jnx1",
        "utc aw937838002",
        "adsense na",
        "connect",
        "file type",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "powershell",
        "b file",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "c0002 wininet",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cndigicert sha2",
        "secure server",
        "ca odigicert",
        "inc cus",
        "subject",
        "cnwe1 ogoogle",
        "trust",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft",
        "get http",
        "request",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "response",
        "united",
        "search",
        "creation date",
        "expiration date",
        "name servers",
        "unknown soa",
        "germany unknown",
        "entries",
        "pulse submit",
        "url analysis",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 304,
        "hostname": 796,
        "URL": 2590,
        "FileHash-SHA256": 2735,
        "FileHash-MD5": 253,
        "FileHash-SHA1": 144,
        "email": 1
      },
      "indicator_count": 6823,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66536881127f5ee988306394",
      "name": "iOS Attack - Crouching Yeti: http://x.com/denverpolice/status/|",
      "description": "Targeted triangulation. Apple iOS iPad. Attack chains of Operation Triangulation involves advanced tactics employed by those acting as secret middleman, deploying spoofed trusted websites, emails, alarming news stories, messages, Bluetooth hacking, if threat actor has full CnC of targets phone via injection (sometimes it's random) can power on B/T.   In Spoofed sites, malicious redirects, iMessage 0day case. Zero-click iMessage exploit seen. Information is sent to attacker and stored. Data harvesting, financial & identity theft, service modification and DoS intended. Used by law enforcement, governments, attorney PI's, cyber security defense, red teams and/or malicious hackers.\n*Crouching Yeti threat description notes: Contextual Indicators: Domain is classified as Social Networking Contextual Indicators: The URL is known benign by Check Point's Threat Cloud Contextual Indicators: Https://x.com is popular among websites with good reputation Contextual Indicators: Domain Cisco Umbrella rank is 312.",
      "modified": "2024-06-25T16:05:26.604000",
      "created": "2024-05-26T16:51:13.962000",
      "tags": [
        "sha256",
        "sha1",
        "pattern match",
        "ascii text",
        "document file",
        "v2 document",
        "crlf line",
        "size",
        "unicode",
        "beginstring",
        "null",
        "hybrid",
        "refresh",
        "body",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "external-resources",
        "dom-modification",
        "third-party-cookies",
        "iframes",
        "trackers",
        "text/html",
        "twitter",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "headers",
        "deny",
        "express",
        "referrer",
        "impacting azure",
        "proofpoint",
        "sneaky server",
        "replacement",
        "unauthorized",
        "switch dns",
        "query",
        "vy binh",
        "hiddentear",
        "et tor",
        "known tor",
        "misc attack",
        "relayrouter",
        "exit",
        "node traffic",
        "date",
        "meta",
        "form",
        "submission",
        "expiresthu",
        "path",
        "secure",
        "self",
        "xcitium verdict",
        "cloud",
        "sophos",
        "history first",
        "analysis",
        "cp",
        "cyber",
        "threat",
        "redrum",
        "hit",
        "men",
        "triangulation",
        "historical ssl",
        "apt suspects",
        "critical cmd",
        "hide",
        "asyncrat",
        "jeremy",
        "government",
        "malicious",
        "yuming",
        "name servers",
        "united",
        "passive dns",
        "urls",
        "creation date",
        "search",
        "expiration date",
        "showing",
        "unknown",
        "next",
        "windows nt",
        "malware beacon",
        "memcommit",
        "generic http",
        "exe upload",
        "outbound",
        "etpro trojan",
        "show",
        "trojan",
        "copy",
        "write",
        "win32",
        "malware",
        "read c",
        "entries",
        "medium",
        "markus",
        "contentlength",
        "write c",
        "delete c",
        "create c",
        "yara detections",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "next pe",
        "as32934",
        "hitmen",
        "local government",
        "scene unit",
        "crime",
        "denver police",
        "address",
        "status",
        "aaaa",
        "apple",
        "less whois",
        "registrar",
        "wannacry",
        "http",
        "unique",
        "url https",
        "related nids",
        "code",
        "screenshot",
        "anity",
        "nsa",
        "shadow",
        "saudi telecom",
        "riyadh address",
        "saudi arabia",
        "abuse",
        "ripe",
        "company isp",
        "number",
        "label saudi",
        "telecom company",
        "jsc regional",
        "riyadh",
        "ripe ncc",
        "registry techc",
        "campus",
        "saudi",
        "ripe network",
        "domain",
        "internet se",
        "emails",
        "system",
        "server tsa",
        "b server",
        "certificate",
        "digicert inc",
        "moved",
        "record value"
      ],
      "references": [
        "http://x.com/denverpolice/status/",
        "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX",
        "Redirects to https://twitter.com?mx=1",
        "IP address: 104.244.42.1  Hosting: Unknown  Running on: Tsa B  CMS: Express",
        "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence",
        "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e",
        "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx",
        "Alerts: packer_entropy packer_upx antivm_memory_available pe_features",
        "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX",
        "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]",
        "Yara Detections: ConventionEngine_Term_Desktop ,  LZMA ,  mpress_2_xx_x86 ,  dbgdetect_procs",
        "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/",
        "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4",
        "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e",
        "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717",
        "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com",
        "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show  100 entr",
        "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com",
        "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.",
        "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html",
        "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html",
        "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah,  Saudi Arabia ASN AS39891 saudi telecom company jsc",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win32/Vflooder.B Checkin",
          "display_name": "Win32/Vflooder.B Checkin",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6723768-0",
          "display_name": "Win.Malware.Vtflooder-6723768-0",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Win32/Vflooder.B vtapi DOS",
          "display_name": "Win32/Vflooder.B vtapi DOS",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win.Trojan.Downloader-63174",
          "display_name": "Win.Trojan.Downloader-63174",
          "target": null
        },
        {
          "id": "Clicker.BGOU",
          "display_name": "Clicker.BGOU",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-752791",
          "display_name": "Win.Trojan.Agent-752791",
          "target": null
        },
        {
          "id": "Win.Dropper.QQpass-9895638-0",
          "display_name": "Win.Dropper.QQpass-9895638-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/QQpass",
          "display_name": "Trojan:Win32/QQpass",
          "target": "/malware/Trojan:Win32/QQpass"
        },
        {
          "id": "WannaCry",
          "display_name": "WannaCry",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1038",
          "name": "DLL Search Order Hijacking",
          "display_name": "T1038 - DLL Search Order Hijacking"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1470",
          "name": "Obtain Device Cloud Backups",
          "display_name": "T1470 - Obtain Device Cloud Backups"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 48,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 350,
        "FileHash-SHA1": 348,
        "FileHash-SHA256": 2659,
        "URL": 7850,
        "domain": 2245,
        "hostname": 3611,
        "SSLCertFingerprint": 4,
        "email": 10,
        "CIDR": 4
      },
      "indicator_count": 17081,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "663 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66536c8eee8d42d670e27723",
      "name": "Eternal Blue _ WannaCry MS17-010  | Apple iOS iMessage injection infiltration",
      "description": "",
      "modified": "2024-06-25T16:05:26.604000",
      "created": "2024-05-26T17:08:30.022000",
      "tags": [
        "sha256",
        "sha1",
        "pattern match",
        "ascii text",
        "document file",
        "v2 document",
        "crlf line",
        "size",
        "unicode",
        "beginstring",
        "null",
        "hybrid",
        "refresh",
        "body",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "external-resources",
        "dom-modification",
        "third-party-cookies",
        "iframes",
        "trackers",
        "text/html",
        "twitter",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "headers",
        "deny",
        "express",
        "referrer",
        "impacting azure",
        "proofpoint",
        "sneaky server",
        "replacement",
        "unauthorized",
        "switch dns",
        "query",
        "vy binh",
        "hiddentear",
        "et tor",
        "known tor",
        "misc attack",
        "relayrouter",
        "exit",
        "node traffic",
        "date",
        "meta",
        "form",
        "submission",
        "expiresthu",
        "path",
        "secure",
        "self",
        "xcitium verdict",
        "cloud",
        "sophos",
        "history first",
        "analysis",
        "cp",
        "cyber",
        "threat",
        "redrum",
        "hit",
        "men",
        "triangulation",
        "historical ssl",
        "apt suspects",
        "critical cmd",
        "hide",
        "asyncrat",
        "jeremy",
        "government",
        "malicious",
        "yuming",
        "name servers",
        "united",
        "passive dns",
        "urls",
        "creation date",
        "search",
        "expiration date",
        "showing",
        "unknown",
        "next",
        "windows nt",
        "malware beacon",
        "memcommit",
        "generic http",
        "exe upload",
        "outbound",
        "etpro trojan",
        "show",
        "trojan",
        "copy",
        "write",
        "win32",
        "malware",
        "read c",
        "entries",
        "medium",
        "markus",
        "contentlength",
        "write c",
        "delete c",
        "create c",
        "yara detections",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "next pe",
        "as32934",
        "hitmen",
        "local government",
        "scene unit",
        "crime",
        "denver police",
        "address",
        "status",
        "aaaa",
        "apple",
        "less whois",
        "registrar",
        "wannacry",
        "http",
        "unique",
        "url https",
        "related nids",
        "code",
        "screenshot",
        "anity",
        "nsa",
        "shadow",
        "saudi telecom",
        "riyadh address",
        "saudi arabia",
        "abuse",
        "ripe",
        "company isp",
        "number",
        "label saudi",
        "telecom company",
        "jsc regional",
        "riyadh",
        "ripe ncc",
        "registry techc",
        "campus",
        "saudi",
        "ripe network",
        "domain",
        "internet se",
        "emails",
        "system",
        "server tsa",
        "b server",
        "certificate",
        "digicert inc",
        "moved",
        "record value"
      ],
      "references": [
        "http://x.com/denverpolice/status/",
        "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX",
        "Redirects to https://twitter.com?mx=1",
        "IP address: 104.244.42.1  Hosting: Unknown  Running on: Tsa B  CMS: Express",
        "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence",
        "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e",
        "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx",
        "Alerts: packer_entropy packer_upx antivm_memory_available pe_features",
        "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX",
        "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]",
        "Yara Detections: ConventionEngine_Term_Desktop ,  LZMA ,  mpress_2_xx_x86 ,  dbgdetect_procs",
        "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/",
        "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4",
        "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e",
        "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717",
        "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com",
        "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show  100 entr",
        "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com",
        "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.",
        "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html",
        "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html",
        "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah,  Saudi Arabia ASN AS39891 saudi telecom company jsc",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win32/Vflooder.B Checkin",
          "display_name": "Win32/Vflooder.B Checkin",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6723768-0",
          "display_name": "Win.Malware.Vtflooder-6723768-0",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Win32/Vflooder.B vtapi DOS",
          "display_name": "Win32/Vflooder.B vtapi DOS",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win.Trojan.Downloader-63174",
          "display_name": "Win.Trojan.Downloader-63174",
          "target": null
        },
        {
          "id": "Clicker.BGOU",
          "display_name": "Clicker.BGOU",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-752791",
          "display_name": "Win.Trojan.Agent-752791",
          "target": null
        },
        {
          "id": "Win.Dropper.QQpass-9895638-0",
          "display_name": "Win.Dropper.QQpass-9895638-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/QQpass",
          "display_name": "Trojan:Win32/QQpass",
          "target": "/malware/Trojan:Win32/QQpass"
        },
        {
          "id": "WannaCry",
          "display_name": "WannaCry",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1038",
          "name": "DLL Search Order Hijacking",
          "display_name": "T1038 - DLL Search Order Hijacking"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1470",
          "name": "Obtain Device Cloud Backups",
          "display_name": "T1470 - Obtain Device Cloud Backups"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66536881127f5ee988306394",
      "export_count": 55,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 350,
        "FileHash-SHA1": 348,
        "FileHash-SHA256": 2659,
        "URL": 7850,
        "domain": 2245,
        "hostname": 3611,
        "SSLCertFingerprint": 4,
        "email": 10,
        "CIDR": 4
      },
      "indicator_count": 17081,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "663 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://help.albacross.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://help.albacross.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630018.7451947
}