{
  "type": "URL",
  "indicator": "https://httpswww.tulach.cc",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://httpswww.tulach.cc",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4310159539,
      "indicator": "https://httpswww.tulach.cc",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "69ddeb45c45f6a3cd721397d",
          "name": "Active attacks  \u2022 Apple \u2022 Tulach",
          "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
          "modified": "2026-04-14T07:22:45.250000",
          "created": "2026-04-14T07:22:45.250000",
          "tags": [
            "url http",
            "ipv4",
            "indicator role",
            "active related",
            "united",
            "moved",
            "gmt content",
            "certificate",
            "all domain",
            "msie",
            "chrome",
            "extraction",
            "data upload",
            "twitter",
            "cookie",
            "extra",
            "include data",
            "review locs",
            "exclude",
            "suggested os",
            "onlv",
            "failed",
            "stop data",
            "read c",
            "unicode",
            "rgba",
            "memcommit",
            "delete",
            "dock",
            "write",
            "execution",
            "sc type",
            "extri",
            "include review",
            "exclude sugges",
            "typ data",
            "a domains",
            "present apr",
            "script urls",
            "files",
            "files ip",
            "address",
            "ios",
            "mac",
            "apple",
            "appleid",
            "itunes",
            "next associated",
            "all ipv4",
            "included ic",
            "uny teade",
            "type hostnar",
            "hostnar hostnar",
            "hostnar",
            "macair",
            "macairaustralia",
            "ipad",
            "ipod",
            "cryptexportkey",
            "invalid pointer",
            "cryptgenkey",
            "stream",
            "defender",
            "delphi",
            "class",
            "stack",
            "format",
            "unknown",
            "united states",
            "phishing",
            "password",
            "traffic redirected",
            "service mod",
            "service execution",
            "youtube",
            "music",
            "streams",
            "songs",
            "played songs",
            "music streams",
            "most played",
            "fonelab",
            "indicator",
            "included iocs",
            "manually add",
            "review ocs",
            "exclude inn",
            "sugges data",
            "find",
            "include",
            "url https",
            "enter sc",
            "type",
            "no matchme",
            "search otx",
            "https",
            "references x",
            "analyze",
            "open th",
            "url data",
            "se http",
            "no match",
            "excluded iocs",
            "iocs",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "analysis date",
            "file score",
            "medium risk",
            "yara detections",
            "contacted",
            "related tags",
            "x vercel",
            "file type",
            "type indicator",
            "role title",
            "related pulses",
            "mulch virtua",
            "library loade",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugt",
            "samuel tulach",
            "unity engine",
            "tulach",
            "sa awareness",
            "sabey",
            "sar cut",
            "autofill",
            "includer review",
            "portiana oney",
            "targeting",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "musickit_1_.js",
            "lazarus",
            "injection",
            "CVE-2017-8570",
            "prefetch2",
            "target",
            "aaaa",
            "ip address",
            "record value",
            "emails",
            "samuel tuachs",
            "sapev",
            "review exclude",
            "monitored target",
            "script",
            "mitre att",
            "ascii text",
            "span",
            "path",
            "iframe",
            "april",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "body",
            "development att",
            "t1055.012 list planting",
            "active"
          ],
          "references": [
            "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
            "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
            "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
            "https://podcasts.apple.com/us/podcast/lazarus",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://help.aiseesoft.jp/blu-ray-player",
            "http://help.aiseesoft.jp/fonelab/",
            "https://action.aiseesoft.jp/itunes.php",
            "http://help.aiseesoft.jp/total-video-converter",
            "http://help.aiseesoft.jp/total-video-converter/",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
            "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
            "http://test-firstmile.digitecgalaxus.ch",
            "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
            "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
            "cdn.rss.applemarketingtools.com",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "1.bing.com.cn",
            "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
            "www.phantomcameras.cn",
            "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
            "podcasts.apple.com \u2022 23.34.32.21",
            "www.apple.com \u2022 23.34.32.199",
            "js-cdn.music.apple.com \u2022 23.78.51.170",
            "http://firstmile.digitecgalaxus.ch",
            "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
            "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
            "Tulach.cc",
            "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
            "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
            "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
            "asp.net domain pointer",
            "developer.x.com",
            "aotx.alienvault.com (aotx.?)",
            "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
            "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1020.001",
              "name": "Traffic Duplication",
              "display_name": "T1020.001 - Traffic Duplication"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591.002",
              "name": "Business Relationships",
              "display_name": "T1591.002 - Business Relationships"
            },
            {
              "id": "T1591.001",
              "name": "Determine Physical Locations",
              "display_name": "T1591.001 - Determine Physical Locations"
            },
            {
              "id": "T1585.001",
              "name": "Social Media Accounts",
              "display_name": "T1585.001 - Social Media Accounts"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1432",
              "name": "Access Contact List",
              "display_name": "T1432 - Access Contact List"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1029,
            "domain": 396,
            "email": 7,
            "URL": 2784,
            "FileHash-SHA256": 898,
            "FileHash-MD5": 79,
            "FileHash-SHA1": 68,
            "IPv4": 35,
            "CVE": 1,
            "SSLCertFingerprint": 13
          },
          "indicator_count": 5310,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "5 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "podcasts.apple.com \u2022 23.34.32.21",
        "http://firstmile.digitecgalaxus.ch",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "aotx.alienvault.com (aotx.?)",
        "www.phantomcameras.cn",
        "http://help.aiseesoft.jp/fonelab/",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "Tulach.cc",
        "http://help.aiseesoft.jp/total-video-converter/",
        "cdn.rss.applemarketingtools.com",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "http://test-firstmile.digitecgalaxus.ch",
        "www.apple.com \u2022 23.34.32.199",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "https://action.aiseesoft.jp/itunes.php",
        "1.bing.com.cn",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "developer.x.com",
        "http://help.aiseesoft.jp/total-video-converter",
        "http://help.aiseesoft.jp/blu-ray-player",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "asp.net domain pointer"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 5314
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/tulach.cc",
    "whois": "http://whois.domaintools.com/tulach.cc",
    "domain": "tulach.cc",
    "hostname": "httpswww.tulach.cc"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "69ddeb45c45f6a3cd721397d",
      "name": "Active attacks  \u2022 Apple \u2022 Tulach",
      "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
      "modified": "2026-04-14T07:22:45.250000",
      "created": "2026-04-14T07:22:45.250000",
      "tags": [
        "url http",
        "ipv4",
        "indicator role",
        "active related",
        "united",
        "moved",
        "gmt content",
        "certificate",
        "all domain",
        "msie",
        "chrome",
        "extraction",
        "data upload",
        "twitter",
        "cookie",
        "extra",
        "include data",
        "review locs",
        "exclude",
        "suggested os",
        "onlv",
        "failed",
        "stop data",
        "read c",
        "unicode",
        "rgba",
        "memcommit",
        "delete",
        "dock",
        "write",
        "execution",
        "sc type",
        "extri",
        "include review",
        "exclude sugges",
        "typ data",
        "a domains",
        "present apr",
        "script urls",
        "files",
        "files ip",
        "address",
        "ios",
        "mac",
        "apple",
        "appleid",
        "itunes",
        "next associated",
        "all ipv4",
        "included ic",
        "uny teade",
        "type hostnar",
        "hostnar hostnar",
        "hostnar",
        "macair",
        "macairaustralia",
        "ipad",
        "ipod",
        "cryptexportkey",
        "invalid pointer",
        "cryptgenkey",
        "stream",
        "defender",
        "delphi",
        "class",
        "stack",
        "format",
        "unknown",
        "united states",
        "phishing",
        "password",
        "traffic redirected",
        "service mod",
        "service execution",
        "youtube",
        "music",
        "streams",
        "songs",
        "played songs",
        "music streams",
        "most played",
        "fonelab",
        "indicator",
        "included iocs",
        "manually add",
        "review ocs",
        "exclude inn",
        "sugges data",
        "find",
        "include",
        "url https",
        "enter sc",
        "type",
        "no matchme",
        "search otx",
        "https",
        "references x",
        "analyze",
        "open th",
        "url data",
        "se http",
        "no match",
        "excluded iocs",
        "iocs",
        "ip whitelisted",
        "whitelisted",
        "tcp include",
        "analysis date",
        "file score",
        "medium risk",
        "yara detections",
        "contacted",
        "related tags",
        "x vercel",
        "file type",
        "type indicator",
        "role title",
        "related pulses",
        "mulch virtua",
        "library loade",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugt",
        "samuel tulach",
        "unity engine",
        "tulach",
        "sa awareness",
        "sabey",
        "sar cut",
        "autofill",
        "includer review",
        "portiana oney",
        "targeting",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "musickit_1_.js",
        "lazarus",
        "injection",
        "CVE-2017-8570",
        "prefetch2",
        "target",
        "aaaa",
        "ip address",
        "record value",
        "emails",
        "samuel tuachs",
        "sapev",
        "review exclude",
        "monitored target",
        "script",
        "mitre att",
        "ascii text",
        "span",
        "path",
        "iframe",
        "april",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "body",
        "development att",
        "t1055.012 list planting",
        "active"
      ],
      "references": [
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://help.aiseesoft.jp/blu-ray-player",
        "http://help.aiseesoft.jp/fonelab/",
        "https://action.aiseesoft.jp/itunes.php",
        "http://help.aiseesoft.jp/total-video-converter",
        "http://help.aiseesoft.jp/total-video-converter/",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "http://test-firstmile.digitecgalaxus.ch",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "cdn.rss.applemarketingtools.com",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "1.bing.com.cn",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "www.phantomcameras.cn",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "podcasts.apple.com \u2022 23.34.32.21",
        "www.apple.com \u2022 23.34.32.199",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "http://firstmile.digitecgalaxus.ch",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "Tulach.cc",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "asp.net domain pointer",
        "developer.x.com",
        "aotx.alienvault.com (aotx.?)",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1020.001",
          "name": "Traffic Duplication",
          "display_name": "T1020.001 - Traffic Duplication"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591.002",
          "name": "Business Relationships",
          "display_name": "T1591.002 - Business Relationships"
        },
        {
          "id": "T1591.001",
          "name": "Determine Physical Locations",
          "display_name": "T1591.001 - Determine Physical Locations"
        },
        {
          "id": "T1585.001",
          "name": "Social Media Accounts",
          "display_name": "T1585.001 - Social Media Accounts"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1432",
          "name": "Access Contact List",
          "display_name": "T1432 - Access Contact List"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1029,
        "domain": 396,
        "email": 7,
        "URL": 2784,
        "FileHash-SHA256": 898,
        "FileHash-MD5": 79,
        "FileHash-SHA1": 68,
        "IPv4": 35,
        "CVE": 1,
        "SSLCertFingerprint": 13
      },
      "indicator_count": 5310,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "5 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://httpswww.tulach.cc",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://httpswww.tulach.cc",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776662219.8578985
}