{
  "type": "URL",
  "indicator": "https://joinm.castingcouch-x.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://joinm.castingcouch-x.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2907525222,
      "indicator": "https://joinm.castingcouch-x.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "6888a85aa32aab22f638d0e6",
          "name": "Autodesk issue in CrowdStrike prior to outage | [by scoreblue]",
          "description": "",
          "modified": "2025-07-29T10:54:18.501000",
          "created": "2025-07-29T10:54:18.501000",
          "tags": [
            "healthy check",
            "ssl bypass",
            "domain tracker",
            "privacy badger",
            "startpage",
            "w11 pc",
            "pass",
            "iocs",
            "all scoreblue",
            "pdf report",
            "pcap",
            "stix",
            "avast avg",
            "no expiration",
            "status",
            "name servers",
            "moved",
            "h1 center",
            "next",
            "sec ch",
            "ch ua",
            "ua platform",
            "emails",
            "certificate",
            "passive dns",
            "urls",
            "encrypt",
            "body",
            "pe32 executable",
            "ms windows",
            "intel",
            "windows control",
            "panel item",
            "dos borland",
            "executable",
            "algorithm",
            "thumbprint",
            "serial number",
            "signing ca",
            "symantec time",
            "stamping",
            "g2 name",
            "g2 issuer",
            "class",
            "code",
            "kb pe",
            "csc corporate",
            "porkbun llc",
            "gandi sas",
            "request",
            "path",
            "get https",
            "get http",
            "response",
            "cachecontrol",
            "pragma",
            "connection",
            "gmt connection",
            "accept",
            "slug",
            "as29789",
            "united",
            "unknown",
            "ransom",
            "heur",
            "server",
            "registrar abuse",
            "san rafael",
            "autodesk",
            "contact phone",
            "registrar url",
            "process32nextw",
            "create c",
            "read c",
            "writeconsolew",
            "delete",
            "write",
            "show",
            "malware",
            "write c",
            "regsetvalueexa",
            "delete c",
            "search",
            "regdword",
            "whitelisted",
            "panda banker",
            "ursnif",
            "win32",
            "persistence",
            "execution",
            "banker",
            "local",
            "domain",
            "servers",
            "pulse pulses",
            "files",
            "ip address",
            "creation date",
            "united kingdom",
            "as9009 m247",
            "ipv4",
            "pulse submit",
            "url analysis",
            "twitter",
            "as16552 tiggee",
            "as397241",
            "as397240",
            "entries",
            "cname",
            "nxdomain",
            "a nxdomain",
            "worm",
            "file samples",
            "files matching",
            "alf features",
            "denver co",
            "wewatta",
            "scan endpoints",
            "related pulses",
            "date hash",
            "showing",
            "as62597 nsone",
            "date",
            "trojanspy",
            "cookie",
            "hostmaster",
            "expiration date",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tls handshake",
            "et info",
            "getdc0x2a",
            "failure",
            "post http",
            "copy",
            "crash",
            "ascii text",
            "ascii",
            "jpeg image",
            "artemis",
            "trojan",
            "virustotal",
            "mike",
            "vipre",
            "panda",
            "win32mediadrug",
            "win324shared",
            "win32spigot",
            "hstr",
            "lowfi",
            "yara detections",
            "contacted",
            "report spam",
            "mozilla",
            "trojanclicker",
            "url http",
            "url https",
            "role title",
            "added active",
            "type indicator",
            "source domain",
            "akamai rank",
            "hostname",
            "ver2",
            "msclkidn",
            "vids0",
            "global outage",
            "cobalt strike",
            "fancy bear",
            "communications",
            "android device",
            "cnc beacon",
            "suspicious ua",
            "youtube",
            "sakula rat",
            "mivast",
            "sakula",
            "windows",
            "samuel tulach",
            "light dark",
            "samuel",
            "tulach",
            "hyperv",
            "detecting",
            "writing gui",
            "bootkits",
            "world",
            "information",
            "discovery",
            "t1027",
            "t1057",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1129",
            "capture",
            "service",
            "t1119"
          ],
          "references": [
            "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
            "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
            "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
            "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
            "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
            "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
            "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
            "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
            "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
            "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
            "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
            "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
            "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
            "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
            "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
            "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
            "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
            "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
            "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
            "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
            "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
            "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
            "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
            "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
            "Above links in search results direct out with and arrow pointing out.",
            "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
            "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
            "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
            "boot.net.anydesk.com removed from my Pulse below",
            "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Win32:Mystic",
              "display_name": "Win32:Mystic",
              "target": null
            },
            {
              "id": "Win.Trojan.Xblocker-236",
              "display_name": "Win.Trojan.Xblocker-236",
              "target": null
            },
            {
              "id": "Ransom:Win32/Genasom",
              "display_name": "Ransom:Win32/Genasom",
              "target": "/malware/Ransom:Win32/Genasom"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Usteal",
              "display_name": "TrojanSpy:Win32/Usteal",
              "target": "/malware/TrojanSpy:Win32/Usteal"
            },
            {
              "id": "Win.Trojan.PoetRat-7669676-0",
              "display_name": "Win.Trojan.PoetRat-7669676-0",
              "target": null
            },
            {
              "id": "Mivast",
              "display_name": "Mivast",
              "target": null
            },
            {
              "id": "Sakula",
              "display_name": "Sakula",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1021",
              "name": "Remote Services",
              "display_name": "T1021 - Remote Services"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "66d89c45ddc0c7db084b75b7",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1417,
            "FileHash-SHA1": 1165,
            "FileHash-SHA256": 6536,
            "URL": 6112,
            "domain": 1340,
            "hostname": 2654,
            "email": 15,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 19248,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "264 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684250a4239beb5281e42ffe",
          "name": "University of Alberta",
          "description": "Find out more about what makes University of Alberta a great place to live, learn, work, study, and learn all over the world, all in the same place, at one of Canada's leading universities.",
          "modified": "2025-07-06T00:02:23.596000",
          "created": "2025-06-06T02:21:24.363000",
          "tags": [
            "university",
            "june",
            "alberta",
            "mtis",
            "college",
            "events",
            "marita",
            "history month",
            "first nations",
            "canada",
            "life",
            "alexander",
            "crime",
            "sport",
            "find",
            "crisis",
            "spring",
            "beyond",
            "tools",
            "sha256",
            "vhash",
            "ssdeep",
            "siblings",
            "oszczdno",
            "whasz",
            "typeof e",
            "name",
            "default",
            "defaulttype",
            "typeerror",
            "error",
            "date",
            "yyyy",
            "regexp",
            "event",
            "null",
            "close",
            "this",
            "void",
            "window",
            "leave",
            "observer"
          ],
          "references": [
            "https://www.ualberta.ca/en/index.html?source=post_page-----4bae31361b51--------------------------------",
            "https://www.ualberta.ca/media-library/ualberta/homepage/university-of-alberta-logo.jpg",
            "http://www.training.ualberta.cloud/",
            "https://www.ualberta.ca/pl/apteka/index.html",
            "http://api.ualberta.cloud/",
            "http://www.ualberta.ca/en/prodps/psp/finprd/?cmd=login",
            "https://www.ualberta.ca/_assets/javascript/framework-v2.js"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 9,
            "FileHash-SHA1": 23,
            "FileHash-SHA256": 7,
            "URL": 500,
            "hostname": 167,
            "domain": 94
          },
          "indicator_count": 800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "287 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d89c45ddc0c7db084b75b7",
          "name": "Autodesk weakens CS | Unauthorized AlienVault API | Stolen pulsed",
          "description": "Critical issues within AlienVault , VT & my devices. Plugins auto installed after I opened  message from AV user. Sudden redirects to 0/ http/s.   Heavy modifications, removal of IoC's  on AV & VT  & Virus Total. Autodesk.com was under CrowdStrike  until last night. Links where vulnerabilities were originating from completely disappeared from graph I kindly kept private. Continuous mods for  months to Crowdstrike and other  pulses. [https://otx.alienvault.com/api appears in search] A page opens with Tag: \"esta caliente\" | All linked pulses Gone. Only person who frequently contacted me appears where they didn't before & These dishonest billion $ companies cover up though they are at fault for allowing ALL threat actor to be protected with  non adversarial businesses.  Besides other compromises, surprisingly Brashears porn found in Crowdstrike/Autodesk  others. Disappointing.",
          "modified": "2024-10-04T17:02:07.067000",
          "created": "2024-09-04T17:43:33.123000",
          "tags": [
            "healthy check",
            "ssl bypass",
            "domain tracker",
            "privacy badger",
            "startpage",
            "w11 pc",
            "pass",
            "iocs",
            "all scoreblue",
            "pdf report",
            "pcap",
            "stix",
            "avast avg",
            "no expiration",
            "status",
            "name servers",
            "moved",
            "h1 center",
            "next",
            "sec ch",
            "ch ua",
            "ua platform",
            "emails",
            "certificate",
            "passive dns",
            "urls",
            "encrypt",
            "body",
            "pe32 executable",
            "ms windows",
            "intel",
            "windows control",
            "panel item",
            "dos borland",
            "executable",
            "algorithm",
            "thumbprint",
            "serial number",
            "signing ca",
            "symantec time",
            "stamping",
            "g2 name",
            "g2 issuer",
            "class",
            "code",
            "kb pe",
            "csc corporate",
            "porkbun llc",
            "gandi sas",
            "request",
            "path",
            "get https",
            "get http",
            "response",
            "cachecontrol",
            "pragma",
            "connection",
            "gmt connection",
            "accept",
            "slug",
            "as29789",
            "united",
            "unknown",
            "ransom",
            "heur",
            "server",
            "registrar abuse",
            "san rafael",
            "autodesk",
            "contact phone",
            "registrar url",
            "process32nextw",
            "create c",
            "read c",
            "writeconsolew",
            "delete",
            "write",
            "show",
            "malware",
            "write c",
            "regsetvalueexa",
            "delete c",
            "search",
            "regdword",
            "whitelisted",
            "panda banker",
            "ursnif",
            "win32",
            "persistence",
            "execution",
            "banker",
            "local",
            "domain",
            "servers",
            "pulse pulses",
            "files",
            "ip address",
            "creation date",
            "united kingdom",
            "as9009 m247",
            "ipv4",
            "pulse submit",
            "url analysis",
            "twitter",
            "as16552 tiggee",
            "as397241",
            "as397240",
            "entries",
            "cname",
            "nxdomain",
            "a nxdomain",
            "worm",
            "file samples",
            "files matching",
            "alf features",
            "denver co",
            "wewatta",
            "scan endpoints",
            "related pulses",
            "date hash",
            "showing",
            "as62597 nsone",
            "date",
            "trojanspy",
            "cookie",
            "hostmaster",
            "expiration date",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tls handshake",
            "et info",
            "getdc0x2a",
            "failure",
            "post http",
            "copy",
            "crash",
            "ascii text",
            "ascii",
            "jpeg image",
            "artemis",
            "trojan",
            "virustotal",
            "mike",
            "vipre",
            "panda",
            "win32mediadrug",
            "win324shared",
            "win32spigot",
            "hstr",
            "lowfi",
            "yara detections",
            "contacted",
            "report spam",
            "mozilla",
            "trojanclicker",
            "url http",
            "url https",
            "role title",
            "added active",
            "type indicator",
            "source domain",
            "akamai rank",
            "hostname",
            "ver2",
            "msclkidn",
            "vids0",
            "global outage",
            "cobalt strike",
            "fancy bear",
            "communications",
            "android device",
            "cnc beacon",
            "suspicious ua",
            "youtube",
            "sakula rat",
            "mivast",
            "sakula",
            "windows",
            "samuel tulach",
            "light dark",
            "samuel",
            "tulach",
            "hyperv",
            "detecting",
            "writing gui",
            "bootkits",
            "world",
            "information",
            "discovery",
            "t1027",
            "t1057",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1129",
            "capture",
            "service",
            "t1119"
          ],
          "references": [
            "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
            "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
            "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
            "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
            "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
            "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
            "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
            "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
            "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
            "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
            "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
            "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
            "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
            "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
            "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
            "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
            "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
            "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
            "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
            "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
            "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
            "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
            "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
            "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
            "Above links in search results direct out with and arrow pointing out.",
            "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
            "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
            "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
            "boot.net.anydesk.com removed from my Pulse below",
            "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Win32:Mystic",
              "display_name": "Win32:Mystic",
              "target": null
            },
            {
              "id": "Win.Trojan.Xblocker-236",
              "display_name": "Win.Trojan.Xblocker-236",
              "target": null
            },
            {
              "id": "Ransom:Win32/Genasom",
              "display_name": "Ransom:Win32/Genasom",
              "target": "/malware/Ransom:Win32/Genasom"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Usteal",
              "display_name": "TrojanSpy:Win32/Usteal",
              "target": "/malware/TrojanSpy:Win32/Usteal"
            },
            {
              "id": "Win.Trojan.PoetRat-7669676-0",
              "display_name": "Win.Trojan.PoetRat-7669676-0",
              "target": null
            },
            {
              "id": "Mivast",
              "display_name": "Mivast",
              "target": null
            },
            {
              "id": "Sakula",
              "display_name": "Sakula",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1021",
              "name": "Remote Services",
              "display_name": "T1021 - Remote Services"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 38,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1417,
            "FileHash-SHA1": 1165,
            "FileHash-SHA256": 6536,
            "URL": 6112,
            "domain": 1340,
            "hostname": 2654,
            "email": 15,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 19248,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "562 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570800373899fd03e2e49db",
          "name": "Democrats.org",
          "description": "",
          "modified": "2023-12-06T14:06:59.250000",
          "created": "2023-12-06T14:06:59.250000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 3114,
            "domain": 3501,
            "hostname": 3860,
            "URL": 17938,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 10
          },
          "indicator_count": 28425,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707f519ef27fa72eb62598",
          "name": "CambridgeAnalytica.org",
          "description": "",
          "modified": "2023-12-06T14:04:01.301000",
          "created": "2023-12-06T14:04:01.301000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 335,
            "URL": 13379,
            "hostname": 2501,
            "domain": 1501,
            "FileHash-SHA1": 15
          },
          "indicator_count": 17731,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707c9df9c33dd5983b366a",
          "name": "TrueCar.com",
          "description": "",
          "modified": "2023-12-06T13:52:29.953000",
          "created": "2023-12-06T13:52:29.953000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1156,
            "domain": 4253,
            "hostname": 4203,
            "URL": 17071,
            "FileHash-MD5": 13,
            "FileHash-SHA1": 5,
            "email": 1
          },
          "indicator_count": 26702,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62374741ab73c46ec3078320",
          "name": "voip ham radio dstar",
          "description": "",
          "modified": "2022-04-19T00:01:05.210000",
          "created": "2022-03-20T15:24:49.672000",
          "tags": [
            "domain related"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 450,
            "hostname": 768,
            "URL": 3685,
            "domain": 351
          },
          "indicator_count": 5254,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1461 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6220c81aaf6fddde0116569a",
          "name": "Democrats.org",
          "description": "",
          "modified": "2022-04-02T00:04:50.405000",
          "created": "2022-03-03T13:52:26.328000",
          "tags": [
            "date",
            "dns replication"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 17938,
            "hostname": 3860,
            "domain": 3501,
            "FileHash-SHA256": 3114,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 10
          },
          "indicator_count": 28425,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 408,
          "modified_text": "1478 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "621927dd57ee9ed86aeb9cb4",
          "name": "CambridgeAnalytica.org",
          "description": "",
          "modified": "2022-03-27T00:00:39.057000",
          "created": "2022-02-25T19:02:53.023000",
          "tags": [
            "win32 exe",
            "scott hanselman",
            "win32 dll",
            "llc creation",
            "date",
            "passive dns",
            "subdomains",
            "detections type",
            "name",
            "rich text",
            "format",
            "music",
            "first"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13379,
            "hostname": 2501,
            "domain": 1501,
            "FileHash-SHA256": 335,
            "FileHash-SHA1": 15
          },
          "indicator_count": 17731,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1484 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "61e2733e9e57250b5725ab5a",
          "name": "TrueCar.com",
          "description": "",
          "modified": "2022-02-14T00:00:26.279000",
          "created": "2022-01-15T07:09:50.416000",
          "tags": [
            "android",
            "win32 exe",
            "key identifier",
            "win32 dll",
            "x509v3 subject",
            "server",
            "date",
            "registrar abuse",
            "algorithm",
            "markmonitor",
            "format",
            "impact",
            "first",
            "text",
            "email",
            "type name",
            "portable",
            "adguard premium",
            "usus",
            "mozilla firefox",
            "technology",
            "microsoft",
            "security",
            "subdomains",
            "threatseeker",
            "sophos",
            "comodo valkyrie",
            "verdict mobile",
            "rank value",
            "ingestion time",
            "statvoo",
            "cisco umbrella",
            "dns records",
            "record type",
            "ttl value",
            "msms94514764",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "domain status",
            "contact phone",
            "registrar",
            "ca creation",
            "dnssec",
            "domain name",
            "us registrant",
            "links https",
            "path",
            "submission",
            "httponly",
            "expiressat",
            "samesitelax",
            "details links",
            "vehicles comodo",
            "history first",
            "analysis"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 17071,
            "hostname": 4203,
            "FileHash-SHA256": 1156,
            "domain": 4253,
            "FileHash-MD5": 13,
            "FileHash-SHA1": 5,
            "email": 1
          },
          "indicator_count": 26702,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 412,
          "modified_text": "1525 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.ualberta.ca/media-library/ualberta/homepage/university-of-alberta-logo.jpg",
        "http://api.ualberta.cloud/",
        "http://www.ualberta.ca/en/prodps/psp/finprd/?cmd=login",
        "http://www.training.ualberta.cloud/",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "boot.net.anydesk.com removed from my Pulse below",
        "https://www.ualberta.ca/_assets/javascript/framework-v2.js",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Above links in search results direct out with and arrow pointing out.",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "https://www.ualberta.ca/pl/apteka/index.html",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "https://www.ualberta.ca/en/index.html?source=post_page-----4bae31361b51--------------------------------"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "#lowfienabledtcontinueafterunpacking",
            "Win.trojan.poetrat-7669676-0",
            "Trojanspy",
            "Mivast",
            "Trojanspy:win32/usteal",
            "Worm:win32/autorun",
            "Sakula",
            "Win32:mystic",
            "Alf:jasyp:backdoor:win32/cycbot",
            "Ransom:win32/genasom",
            "Win.trojan.xblocker-236"
          ],
          "industries": [],
          "unique_indicators": 85893
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/castingcouch-x.com",
    "whois": "http://whois.domaintools.com/castingcouch-x.com",
    "domain": "castingcouch-x.com",
    "hostname": "joinm.castingcouch-x.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "6888a85aa32aab22f638d0e6",
      "name": "Autodesk issue in CrowdStrike prior to outage | [by scoreblue]",
      "description": "",
      "modified": "2025-07-29T10:54:18.501000",
      "created": "2025-07-29T10:54:18.501000",
      "tags": [
        "healthy check",
        "ssl bypass",
        "domain tracker",
        "privacy badger",
        "startpage",
        "w11 pc",
        "pass",
        "iocs",
        "all scoreblue",
        "pdf report",
        "pcap",
        "stix",
        "avast avg",
        "no expiration",
        "status",
        "name servers",
        "moved",
        "h1 center",
        "next",
        "sec ch",
        "ch ua",
        "ua platform",
        "emails",
        "certificate",
        "passive dns",
        "urls",
        "encrypt",
        "body",
        "pe32 executable",
        "ms windows",
        "intel",
        "windows control",
        "panel item",
        "dos borland",
        "executable",
        "algorithm",
        "thumbprint",
        "serial number",
        "signing ca",
        "symantec time",
        "stamping",
        "g2 name",
        "g2 issuer",
        "class",
        "code",
        "kb pe",
        "csc corporate",
        "porkbun llc",
        "gandi sas",
        "request",
        "path",
        "get https",
        "get http",
        "response",
        "cachecontrol",
        "pragma",
        "connection",
        "gmt connection",
        "accept",
        "slug",
        "as29789",
        "united",
        "unknown",
        "ransom",
        "heur",
        "server",
        "registrar abuse",
        "san rafael",
        "autodesk",
        "contact phone",
        "registrar url",
        "process32nextw",
        "create c",
        "read c",
        "writeconsolew",
        "delete",
        "write",
        "show",
        "malware",
        "write c",
        "regsetvalueexa",
        "delete c",
        "search",
        "regdword",
        "whitelisted",
        "panda banker",
        "ursnif",
        "win32",
        "persistence",
        "execution",
        "banker",
        "local",
        "domain",
        "servers",
        "pulse pulses",
        "files",
        "ip address",
        "creation date",
        "united kingdom",
        "as9009 m247",
        "ipv4",
        "pulse submit",
        "url analysis",
        "twitter",
        "as16552 tiggee",
        "as397241",
        "as397240",
        "entries",
        "cname",
        "nxdomain",
        "a nxdomain",
        "worm",
        "file samples",
        "files matching",
        "alf features",
        "denver co",
        "wewatta",
        "scan endpoints",
        "related pulses",
        "date hash",
        "showing",
        "as62597 nsone",
        "date",
        "trojanspy",
        "cookie",
        "hostmaster",
        "expiration date",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tls handshake",
        "et info",
        "getdc0x2a",
        "failure",
        "post http",
        "copy",
        "crash",
        "ascii text",
        "ascii",
        "jpeg image",
        "artemis",
        "trojan",
        "virustotal",
        "mike",
        "vipre",
        "panda",
        "win32mediadrug",
        "win324shared",
        "win32spigot",
        "hstr",
        "lowfi",
        "yara detections",
        "contacted",
        "report spam",
        "mozilla",
        "trojanclicker",
        "url http",
        "url https",
        "role title",
        "added active",
        "type indicator",
        "source domain",
        "akamai rank",
        "hostname",
        "ver2",
        "msclkidn",
        "vids0",
        "global outage",
        "cobalt strike",
        "fancy bear",
        "communications",
        "android device",
        "cnc beacon",
        "suspicious ua",
        "youtube",
        "sakula rat",
        "mivast",
        "sakula",
        "windows",
        "samuel tulach",
        "light dark",
        "samuel",
        "tulach",
        "hyperv",
        "detecting",
        "writing gui",
        "bootkits",
        "world",
        "information",
        "discovery",
        "t1027",
        "t1057",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1129",
        "capture",
        "service",
        "t1119"
      ],
      "references": [
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Above links in search results direct out with and arrow pointing out.",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "boot.net.anydesk.com removed from my Pulse below",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Win32:Mystic",
          "display_name": "Win32:Mystic",
          "target": null
        },
        {
          "id": "Win.Trojan.Xblocker-236",
          "display_name": "Win.Trojan.Xblocker-236",
          "target": null
        },
        {
          "id": "Ransom:Win32/Genasom",
          "display_name": "Ransom:Win32/Genasom",
          "target": "/malware/Ransom:Win32/Genasom"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Usteal",
          "display_name": "TrojanSpy:Win32/Usteal",
          "target": "/malware/TrojanSpy:Win32/Usteal"
        },
        {
          "id": "Win.Trojan.PoetRat-7669676-0",
          "display_name": "Win.Trojan.PoetRat-7669676-0",
          "target": null
        },
        {
          "id": "Mivast",
          "display_name": "Mivast",
          "target": null
        },
        {
          "id": "Sakula",
          "display_name": "Sakula",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "display_name": "T1021 - Remote Services"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "66d89c45ddc0c7db084b75b7",
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1417,
        "FileHash-SHA1": 1165,
        "FileHash-SHA256": 6536,
        "URL": 6112,
        "domain": 1340,
        "hostname": 2654,
        "email": 15,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 19248,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "264 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "684250a4239beb5281e42ffe",
      "name": "University of Alberta",
      "description": "Find out more about what makes University of Alberta a great place to live, learn, work, study, and learn all over the world, all in the same place, at one of Canada's leading universities.",
      "modified": "2025-07-06T00:02:23.596000",
      "created": "2025-06-06T02:21:24.363000",
      "tags": [
        "university",
        "june",
        "alberta",
        "mtis",
        "college",
        "events",
        "marita",
        "history month",
        "first nations",
        "canada",
        "life",
        "alexander",
        "crime",
        "sport",
        "find",
        "crisis",
        "spring",
        "beyond",
        "tools",
        "sha256",
        "vhash",
        "ssdeep",
        "siblings",
        "oszczdno",
        "whasz",
        "typeof e",
        "name",
        "default",
        "defaulttype",
        "typeerror",
        "error",
        "date",
        "yyyy",
        "regexp",
        "event",
        "null",
        "close",
        "this",
        "void",
        "window",
        "leave",
        "observer"
      ],
      "references": [
        "https://www.ualberta.ca/en/index.html?source=post_page-----4bae31361b51--------------------------------",
        "https://www.ualberta.ca/media-library/ualberta/homepage/university-of-alberta-logo.jpg",
        "http://www.training.ualberta.cloud/",
        "https://www.ualberta.ca/pl/apteka/index.html",
        "http://api.ualberta.cloud/",
        "http://www.ualberta.ca/en/prodps/psp/finprd/?cmd=login",
        "https://www.ualberta.ca/_assets/javascript/framework-v2.js"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 9,
        "FileHash-SHA1": 23,
        "FileHash-SHA256": 7,
        "URL": 500,
        "hostname": 167,
        "domain": 94
      },
      "indicator_count": 800,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "287 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d89c45ddc0c7db084b75b7",
      "name": "Autodesk weakens CS | Unauthorized AlienVault API | Stolen pulsed",
      "description": "Critical issues within AlienVault , VT & my devices. Plugins auto installed after I opened  message from AV user. Sudden redirects to 0/ http/s.   Heavy modifications, removal of IoC's  on AV & VT  & Virus Total. Autodesk.com was under CrowdStrike  until last night. Links where vulnerabilities were originating from completely disappeared from graph I kindly kept private. Continuous mods for  months to Crowdstrike and other  pulses. [https://otx.alienvault.com/api appears in search] A page opens with Tag: \"esta caliente\" | All linked pulses Gone. Only person who frequently contacted me appears where they didn't before & These dishonest billion $ companies cover up though they are at fault for allowing ALL threat actor to be protected with  non adversarial businesses.  Besides other compromises, surprisingly Brashears porn found in Crowdstrike/Autodesk  others. Disappointing.",
      "modified": "2024-10-04T17:02:07.067000",
      "created": "2024-09-04T17:43:33.123000",
      "tags": [
        "healthy check",
        "ssl bypass",
        "domain tracker",
        "privacy badger",
        "startpage",
        "w11 pc",
        "pass",
        "iocs",
        "all scoreblue",
        "pdf report",
        "pcap",
        "stix",
        "avast avg",
        "no expiration",
        "status",
        "name servers",
        "moved",
        "h1 center",
        "next",
        "sec ch",
        "ch ua",
        "ua platform",
        "emails",
        "certificate",
        "passive dns",
        "urls",
        "encrypt",
        "body",
        "pe32 executable",
        "ms windows",
        "intel",
        "windows control",
        "panel item",
        "dos borland",
        "executable",
        "algorithm",
        "thumbprint",
        "serial number",
        "signing ca",
        "symantec time",
        "stamping",
        "g2 name",
        "g2 issuer",
        "class",
        "code",
        "kb pe",
        "csc corporate",
        "porkbun llc",
        "gandi sas",
        "request",
        "path",
        "get https",
        "get http",
        "response",
        "cachecontrol",
        "pragma",
        "connection",
        "gmt connection",
        "accept",
        "slug",
        "as29789",
        "united",
        "unknown",
        "ransom",
        "heur",
        "server",
        "registrar abuse",
        "san rafael",
        "autodesk",
        "contact phone",
        "registrar url",
        "process32nextw",
        "create c",
        "read c",
        "writeconsolew",
        "delete",
        "write",
        "show",
        "malware",
        "write c",
        "regsetvalueexa",
        "delete c",
        "search",
        "regdword",
        "whitelisted",
        "panda banker",
        "ursnif",
        "win32",
        "persistence",
        "execution",
        "banker",
        "local",
        "domain",
        "servers",
        "pulse pulses",
        "files",
        "ip address",
        "creation date",
        "united kingdom",
        "as9009 m247",
        "ipv4",
        "pulse submit",
        "url analysis",
        "twitter",
        "as16552 tiggee",
        "as397241",
        "as397240",
        "entries",
        "cname",
        "nxdomain",
        "a nxdomain",
        "worm",
        "file samples",
        "files matching",
        "alf features",
        "denver co",
        "wewatta",
        "scan endpoints",
        "related pulses",
        "date hash",
        "showing",
        "as62597 nsone",
        "date",
        "trojanspy",
        "cookie",
        "hostmaster",
        "expiration date",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tls handshake",
        "et info",
        "getdc0x2a",
        "failure",
        "post http",
        "copy",
        "crash",
        "ascii text",
        "ascii",
        "jpeg image",
        "artemis",
        "trojan",
        "virustotal",
        "mike",
        "vipre",
        "panda",
        "win32mediadrug",
        "win324shared",
        "win32spigot",
        "hstr",
        "lowfi",
        "yara detections",
        "contacted",
        "report spam",
        "mozilla",
        "trojanclicker",
        "url http",
        "url https",
        "role title",
        "added active",
        "type indicator",
        "source domain",
        "akamai rank",
        "hostname",
        "ver2",
        "msclkidn",
        "vids0",
        "global outage",
        "cobalt strike",
        "fancy bear",
        "communications",
        "android device",
        "cnc beacon",
        "suspicious ua",
        "youtube",
        "sakula rat",
        "mivast",
        "sakula",
        "windows",
        "samuel tulach",
        "light dark",
        "samuel",
        "tulach",
        "hyperv",
        "detecting",
        "writing gui",
        "bootkits",
        "world",
        "information",
        "discovery",
        "t1027",
        "t1057",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1129",
        "capture",
        "service",
        "t1119"
      ],
      "references": [
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Above links in search results direct out with and arrow pointing out.",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "boot.net.anydesk.com removed from my Pulse below",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Win32:Mystic",
          "display_name": "Win32:Mystic",
          "target": null
        },
        {
          "id": "Win.Trojan.Xblocker-236",
          "display_name": "Win.Trojan.Xblocker-236",
          "target": null
        },
        {
          "id": "Ransom:Win32/Genasom",
          "display_name": "Ransom:Win32/Genasom",
          "target": "/malware/Ransom:Win32/Genasom"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Usteal",
          "display_name": "TrojanSpy:Win32/Usteal",
          "target": "/malware/TrojanSpy:Win32/Usteal"
        },
        {
          "id": "Win.Trojan.PoetRat-7669676-0",
          "display_name": "Win.Trojan.PoetRat-7669676-0",
          "target": null
        },
        {
          "id": "Mivast",
          "display_name": "Mivast",
          "target": null
        },
        {
          "id": "Sakula",
          "display_name": "Sakula",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "display_name": "T1021 - Remote Services"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 38,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1417,
        "FileHash-SHA1": 1165,
        "FileHash-SHA256": 6536,
        "URL": 6112,
        "domain": 1340,
        "hostname": 2654,
        "email": 15,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 19248,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "562 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570800373899fd03e2e49db",
      "name": "Democrats.org",
      "description": "",
      "modified": "2023-12-06T14:06:59.250000",
      "created": "2023-12-06T14:06:59.250000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 3114,
        "domain": 3501,
        "hostname": 3860,
        "URL": 17938,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 10
      },
      "indicator_count": 28425,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707f519ef27fa72eb62598",
      "name": "CambridgeAnalytica.org",
      "description": "",
      "modified": "2023-12-06T14:04:01.301000",
      "created": "2023-12-06T14:04:01.301000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 335,
        "URL": 13379,
        "hostname": 2501,
        "domain": 1501,
        "FileHash-SHA1": 15
      },
      "indicator_count": 17731,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707c9df9c33dd5983b366a",
      "name": "TrueCar.com",
      "description": "",
      "modified": "2023-12-06T13:52:29.953000",
      "created": "2023-12-06T13:52:29.953000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1156,
        "domain": 4253,
        "hostname": 4203,
        "URL": 17071,
        "FileHash-MD5": 13,
        "FileHash-SHA1": 5,
        "email": 1
      },
      "indicator_count": 26702,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62374741ab73c46ec3078320",
      "name": "voip ham radio dstar",
      "description": "",
      "modified": "2022-04-19T00:01:05.210000",
      "created": "2022-03-20T15:24:49.672000",
      "tags": [
        "domain related"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 450,
        "hostname": 768,
        "URL": 3685,
        "domain": 351
      },
      "indicator_count": 5254,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 392,
      "modified_text": "1461 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6220c81aaf6fddde0116569a",
      "name": "Democrats.org",
      "description": "",
      "modified": "2022-04-02T00:04:50.405000",
      "created": "2022-03-03T13:52:26.328000",
      "tags": [
        "date",
        "dns replication"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 17938,
        "hostname": 3860,
        "domain": 3501,
        "FileHash-SHA256": 3114,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 10
      },
      "indicator_count": 28425,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 408,
      "modified_text": "1478 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "621927dd57ee9ed86aeb9cb4",
      "name": "CambridgeAnalytica.org",
      "description": "",
      "modified": "2022-03-27T00:00:39.057000",
      "created": "2022-02-25T19:02:53.023000",
      "tags": [
        "win32 exe",
        "scott hanselman",
        "win32 dll",
        "llc creation",
        "date",
        "passive dns",
        "subdomains",
        "detections type",
        "name",
        "rich text",
        "format",
        "music",
        "first"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13379,
        "hostname": 2501,
        "domain": 1501,
        "FileHash-SHA256": 335,
        "FileHash-SHA1": 15
      },
      "indicator_count": 17731,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 406,
      "modified_text": "1484 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "61e2733e9e57250b5725ab5a",
      "name": "TrueCar.com",
      "description": "",
      "modified": "2022-02-14T00:00:26.279000",
      "created": "2022-01-15T07:09:50.416000",
      "tags": [
        "android",
        "win32 exe",
        "key identifier",
        "win32 dll",
        "x509v3 subject",
        "server",
        "date",
        "registrar abuse",
        "algorithm",
        "markmonitor",
        "format",
        "impact",
        "first",
        "text",
        "email",
        "type name",
        "portable",
        "adguard premium",
        "usus",
        "mozilla firefox",
        "technology",
        "microsoft",
        "security",
        "subdomains",
        "threatseeker",
        "sophos",
        "comodo valkyrie",
        "verdict mobile",
        "rank value",
        "ingestion time",
        "statvoo",
        "cisco umbrella",
        "dns records",
        "record type",
        "ttl value",
        "msms94514764",
        "data",
        "v3 serial",
        "number",
        "issuer",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "domain status",
        "contact phone",
        "registrar",
        "ca creation",
        "dnssec",
        "domain name",
        "us registrant",
        "links https",
        "path",
        "submission",
        "httponly",
        "expiressat",
        "samesitelax",
        "details links",
        "vehicles comodo",
        "history first",
        "analysis"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 17071,
        "hostname": 4203,
        "FileHash-SHA256": 1156,
        "domain": 4253,
        "FileHash-MD5": 13,
        "FileHash-SHA1": 5,
        "email": 1
      },
      "indicator_count": 26702,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 412,
      "modified_text": "1525 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://joinm.castingcouch-x.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://joinm.castingcouch-x.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776639006.6370173
}