{
  "type": "URL",
  "indicator": "https://kolejnik.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://kolejnik.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3777227240,
      "indicator": "https://kolejnik.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 18,
      "pulses": [
        {
          "id": "65f980ad16123b5d52f5f76f",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com [Report originated from octoseek]",
          "description": "",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-19T12:10:21.291000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65f4ba867ec44a4dc0e6fc96",
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 235,
          "modified_text": "737 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f4ba867ec44a4dc0e6fc96",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com",
          "description": "Jiuxiu Live - High-quality beauty online video interactive community - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -porn dump. Performed tiny DNS test on affected target. \nDNS stuffing  pornography. DNSpionage , custom browser, DNS tunneling encoding  data, programs, protocols, DNS queries, responses, amplification attack; perform  (DDoS) on server, flood attack,  spoofing.  Attack. Miles IT & affiliated logging inas target. Pitfall of being compromised for some; you won't speak to legitimate business unless you know & recognize voice. \nSome notations in references.",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-15T21:15:50.802000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 60,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "737 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659d687f92ebb4f3d613ae0c",
          "name": "Mimikatz | www.ssc.spaceforce.mil ",
          "description": "",
          "modified": "2024-01-09T15:38:39.547000",
          "created": "2024-01-09T15:38:39.547000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655cd0f065d2e5a6c92369e5",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "832 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656aa27f81a9096f5889a9d0",
          "name": "WebToolbar | www.ssc.spaceforce.mil ",
          "description": "",
          "modified": "2023-12-21T15:00:07.190000",
          "created": "2023-12-02T03:20:31.494000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655cd0f065d2e5a6c92369e5",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "851 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655ce5116519bd86d1f1bdee",
          "name": "FormBook | www.ssc.spaceforce.mil 'Hoax' | Spyware | Fraud Services",
          "description": "",
          "modified": "2023-12-21T15:00:07.190000",
          "created": "2023-11-21T17:12:49.783000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "851 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655cd0f065d2e5a6c92369e5",
          "name": "www.ssc.spaceforce.mil",
          "description": "",
          "modified": "2023-12-21T15:00:07.190000",
          "created": "2023-11-21T15:46:56.740000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "851 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65403022038832e42175601f",
          "name": "CRITICAL!!! | Health Insurance Cyber threat Matrix - Darkside 2020 Ecosystem .BEware ",
          "description": "",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T22:37:22.425000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": "65402a8dec948bec8b0a0372",
          "export_count": 95,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 8601,
            "URL": 7499,
            "domain": 4604,
            "hostname": 4187,
            "CIDR": 2,
            "CVE": 23,
            "URI": 1
          },
          "indicator_count": 25942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6544cbbca7610e92e4262c47",
          "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Targeting",
          "description": "",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-11-03T10:30:20.965000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": "654140bae73f795aa914e8de",
          "export_count": 108,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654140bae73f795aa914e8de",
          "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears",
          "description": "",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-31T18:00:26.439000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": "65401d73e96dd70037ed22a7",
          "export_count": 98,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d5ee5a7359a5e815a6a",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:18.712000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65402a8dec948bec8b0a0372",
          "name": "24 CVE's | Health Liability bDarkside 2020 Ecosystem .BEware",
          "description": "Matrix of cyber crime attacks appears to involved legal entities and a division of Workers Compensation Colorado, possibly used nationally. Targeting, monitoring, tracking, malvertizing, cyber attacks, CNC. Critical.\nCould probably be disputed $$$$ though undisputable. \nEd Said. \nhttp://1.116.132.182/weblogic_CVE_2020_2551.jar\t\t\t\nCVE-2020-0601\t\t\t\t\t\nCVE-2018-8174\t\t\t\nCVE-2018-4893\t\t\t\nCVE-2018-0802\t\t\t\nCVE-2017-8759\t\t\t\t\t\t\nCVE-2017-8464\t\t\t\nCVE-2017-1188\t\t\t\t\nCVE-2017-0143\t\t\t\nCVE-2016-7262\t\t\t\nCVE-2014-6352\t\t\t\nCVE-2013-2465\t\t\t\nCVE-2011-2110\t\t\t\nCVE-2011-0609\t\t\t\nCVE-2010-2568\t\t\t\nCVE-2018-8453\t\t\t\nCVE-2013-1331\nCVE-2012-1856\t\t\t\t\nCVE-2012-0158\t\t\t\t\t\t\nCVE-2017-8570\t\t\t\nCVE-2017-11882\t\t\t\nCVE-2017-0199\t\t\t\t\t\t\nCVE-2017-0147\t\t\t\t\t\t\nCVE-2014-3153",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T22:13:33.427000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 92,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 8601,
            "URL": 7499,
            "domain": 4603,
            "hostname": 4187,
            "CIDR": 2,
            "CVE": 23
          },
          "indicator_count": 25940,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401fddb74fe1ea8506132d",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "Law Enforcement? DOJ? ACLU? Help? This is CRAZY.\nSilencing.\nI like her song clicked on link but it was malicious. I was redirected to an Indian link that looked like YouTube.\nI am a professional, awarded researcher in many areas, parent, security researcher, graphic designer, supplier, music lover ,  disabled. overly curious and hacked. HELP. SCARED",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:27:57.026000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 92,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 8601,
            "URL": 7499,
            "domain": 4603,
            "hostname": 4187,
            "CIDR": 2,
            "CVE": 23
          },
          "indicator_count": 25940,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401fcb063a0a34fa323603",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "Law Enforcement? DOJ? ACLU? Help? This is CRAZY.\nSilencing.\nI like her song clicked on link but it was malicious. I was redirected to an Indian link that looked like YouTube.\nI am a professional, awarded researcher in many areas, parent, security researcher, graphic designer, supplier, music lover ,  disabled. overly curious and hacked. HELP. SCARED",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:27:39.980000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 87,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 8601,
            "URL": 7499,
            "domain": 4603,
            "hostname": 4187,
            "CIDR": 2,
            "CVE": 23
          },
          "indicator_count": 25940,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401dbe47ce126e7468a2dc",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I'm actually uncomfortable finding this.",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:18:54.411000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 85,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 8601,
            "URL": 7499,
            "domain": 4603,
            "hostname": 4187,
            "CIDR": 2,
            "CVE": 23
          },
          "indicator_count": 25940,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401da888067e7f6379d23e",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I'm actually uncomfortable finding this.",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:18:32.141000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 84,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 8601,
            "URL": 7499,
            "domain": 4603,
            "hostname": 4187,
            "CIDR": 2,
            "CVE": 23
          },
          "indicator_count": 25940,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d8480e4a9ed725f6458",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:56.820000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d76b057b79aaf7ba4a7",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:40.239000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 84,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d73e96dd70037ed22a7",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:39.802000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Self whitelisting tool, domains moved within nginx.",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Zbot",
            "Blacknet",
            "Bulz",
            "Webtoolbar",
            "Maltiverse",
            "Kryptik",
            "Fragtor",
            "Quasar"
          ],
          "industries": [
            "Health"
          ],
          "unique_indicators": 74015
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/kolejnik.com",
    "whois": "http://whois.domaintools.com/kolejnik.com",
    "domain": "kolejnik.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 18,
  "pulses": [
    {
      "id": "65f980ad16123b5d52f5f76f",
      "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com [Report originated from octoseek]",
      "description": "",
      "modified": "2024-04-13T11:00:32.548000",
      "created": "2024-03-19T12:10:21.291000",
      "tags": [
        "q htpps",
        "g htpps",
        "q https",
        "virustotal",
        "exif standard",
        "tiff image",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "default",
        "jpeg image",
        "search",
        "copy",
        "code",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "next",
        "create c",
        "delete c",
        "intel",
        "ms windows",
        "pe32",
        "precreate read",
        "united",
        "show",
        "regsetvalueexa",
        "trojan",
        "markus",
        "mozilla",
        "write c",
        "json",
        "entries",
        "ascii text",
        "data",
        "as15169",
        "error",
        "malware",
        "win64",
        "denmark as32934",
        "ip hostname",
        "reverse ip",
        "lookup country",
        "as7018 att",
        "as14618",
        "as54113",
        "country code",
        "as36081 state",
        "redirect chain",
        "redirection",
        "location",
        "lakewood",
        "emails",
        "as name",
        "ssl certificate",
        "whois record",
        "k0pmbc",
        "spsfsb",
        "zwdk9d",
        "vwdzfe",
        "contacted",
        "referrer",
        "ntmzac",
        "historical ssl",
        "august",
        "hacktool",
        "core",
        "agent tesla",
        "emotet",
        "chaos",
        "ransomexx",
        "quasar",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "markmonitor",
        "epic games",
        "iana id",
        "contact phone",
        "domain status",
        "registrar whois",
        "registrar",
        "win32 exe",
        "python",
        "launchres",
        "win32 dll",
        "unrealengine",
        "detections type",
        "name",
        "bundled",
        "ctsu",
        "smokeloader",
        "privateloader",
        "relic",
        "monitoring",
        "startpage",
        "\u7f8e\u5973\u76f4\u64ad",
        "\u7f8e\u5973\u89c6\u9891",
        "\u7f8e\u5973\u4e3b\u64ad",
        "\u89c6\u9891\u804a\u5929",
        "\u89c6\u9891\u4ea4\u53cb",
        "\u7f8e\u5973\u4ea4\u53cb",
        "\u7f8e\u5973\u79c0\u573a",
        "\u6e05\u7eaf\u7f8e\u5973",
        "\u6027\u611f\u7f8e\u5973",
        "\u7f8e\u5973\u4e92\u52a8",
        "\u7f8e\u5973\u804a\u5929",
        "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
        "\u7f8e\u5973\u76f4\u64ad\u95f4",
        "\u7f8e\u5973\u804a\u5929\u5ba4",
        "icp2021030667",
        "0110542",
        "copyright",
        "rights reserved",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "siblings",
        "parent domain",
        "cname",
        "whitelisted",
        "status",
        "as15169 google",
        "asnone united",
        "servers",
        "aaaa",
        "body",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "site top",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "million alexa",
        "site safe",
        "malicious site",
        "unsafe",
        "alexa",
        "riskware",
        "artemis",
        "blacknet rat",
        "quasar rat",
        "crack",
        "presenoker",
        "dapato",
        "stealer",
        "phish",
        "memscan",
        "nsis",
        "phishing",
        "bulz",
        "maltiverse",
        "trojanspy",
        "blacknet",
        "zbot",
        "aig",
        "unknown",
        "passive dns",
        "urls",
        "expiresthu",
        "gmt path",
        "scan endpoints",
        "encrypt",
        "dynamicloader",
        "high",
        "medium",
        "qaeaav12",
        "windows",
        "cape",
        "windows wget",
        "suspicious",
        "powershell",
        "canvas",
        "form",
        "showing",
        "all octoseek",
        "url https",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "cus cnr3",
        "olet",
        "l http",
        "wifi",
        "wifi access",
        "wifi hotspot",
        "wifi internet",
        "southwest wifi",
        "inflight",
        "inflight entertainment",
        "southwest",
        "comedy",
        "internet",
        "strong",
        "drama",
        "google chrome",
        "business select",
        "internet access",
        "apple safari",
        "book",
        "rapid",
        "love",
        "summer",
        "poppy",
        "floyd",
        "district",
        "jackson",
        "kevin",
        "live",
        "music",
        "upgrade",
        "gift",
        "lost",
        "carol",
        "canada",
        "cobalt strike",
        "malicious",
        "fragtor",
        "phishing paypal",
        "mail spammer"
      ],
      "references": [
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Self whitelisting tool, domains moved within nginx."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Bulz",
          "display_name": "Bulz",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Fragtor",
          "display_name": "Fragtor",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65f4ba867ec44a4dc0e6fc96",
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8753,
        "domain": 1525,
        "hostname": 3740,
        "FileHash-SHA256": 6746,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 509,
        "SSLCertFingerprint": 3,
        "CVE": 8,
        "CIDR": 5,
        "email": 7
      },
      "indicator_count": 21915,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 235,
      "modified_text": "737 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f4ba867ec44a4dc0e6fc96",
      "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com",
      "description": "Jiuxiu Live - High-quality beauty online video interactive community - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -porn dump. Performed tiny DNS test on affected target. \nDNS stuffing  pornography. DNSpionage , custom browser, DNS tunneling encoding  data, programs, protocols, DNS queries, responses, amplification attack; perform  (DDoS) on server, flood attack,  spoofing.  Attack. Miles IT & affiliated logging inas target. Pitfall of being compromised for some; you won't speak to legitimate business unless you know & recognize voice. \nSome notations in references.",
      "modified": "2024-04-13T11:00:32.548000",
      "created": "2024-03-15T21:15:50.802000",
      "tags": [
        "q htpps",
        "g htpps",
        "q https",
        "virustotal",
        "exif standard",
        "tiff image",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "default",
        "jpeg image",
        "search",
        "copy",
        "code",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "next",
        "create c",
        "delete c",
        "intel",
        "ms windows",
        "pe32",
        "precreate read",
        "united",
        "show",
        "regsetvalueexa",
        "trojan",
        "markus",
        "mozilla",
        "write c",
        "json",
        "entries",
        "ascii text",
        "data",
        "as15169",
        "error",
        "malware",
        "win64",
        "denmark as32934",
        "ip hostname",
        "reverse ip",
        "lookup country",
        "as7018 att",
        "as14618",
        "as54113",
        "country code",
        "as36081 state",
        "redirect chain",
        "redirection",
        "location",
        "lakewood",
        "emails",
        "as name",
        "ssl certificate",
        "whois record",
        "k0pmbc",
        "spsfsb",
        "zwdk9d",
        "vwdzfe",
        "contacted",
        "referrer",
        "ntmzac",
        "historical ssl",
        "august",
        "hacktool",
        "core",
        "agent tesla",
        "emotet",
        "chaos",
        "ransomexx",
        "quasar",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "markmonitor",
        "epic games",
        "iana id",
        "contact phone",
        "domain status",
        "registrar whois",
        "registrar",
        "win32 exe",
        "python",
        "launchres",
        "win32 dll",
        "unrealengine",
        "detections type",
        "name",
        "bundled",
        "ctsu",
        "smokeloader",
        "privateloader",
        "relic",
        "monitoring",
        "startpage",
        "\u7f8e\u5973\u76f4\u64ad",
        "\u7f8e\u5973\u89c6\u9891",
        "\u7f8e\u5973\u4e3b\u64ad",
        "\u89c6\u9891\u804a\u5929",
        "\u89c6\u9891\u4ea4\u53cb",
        "\u7f8e\u5973\u4ea4\u53cb",
        "\u7f8e\u5973\u79c0\u573a",
        "\u6e05\u7eaf\u7f8e\u5973",
        "\u6027\u611f\u7f8e\u5973",
        "\u7f8e\u5973\u4e92\u52a8",
        "\u7f8e\u5973\u804a\u5929",
        "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
        "\u7f8e\u5973\u76f4\u64ad\u95f4",
        "\u7f8e\u5973\u804a\u5929\u5ba4",
        "icp2021030667",
        "0110542",
        "copyright",
        "rights reserved",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "siblings",
        "parent domain",
        "cname",
        "whitelisted",
        "status",
        "as15169 google",
        "asnone united",
        "servers",
        "aaaa",
        "body",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "site top",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "million alexa",
        "site safe",
        "malicious site",
        "unsafe",
        "alexa",
        "riskware",
        "artemis",
        "blacknet rat",
        "quasar rat",
        "crack",
        "presenoker",
        "dapato",
        "stealer",
        "phish",
        "memscan",
        "nsis",
        "phishing",
        "bulz",
        "maltiverse",
        "trojanspy",
        "blacknet",
        "zbot",
        "aig",
        "unknown",
        "passive dns",
        "urls",
        "expiresthu",
        "gmt path",
        "scan endpoints",
        "encrypt",
        "dynamicloader",
        "high",
        "medium",
        "qaeaav12",
        "windows",
        "cape",
        "windows wget",
        "suspicious",
        "powershell",
        "canvas",
        "form",
        "showing",
        "all octoseek",
        "url https",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "cus cnr3",
        "olet",
        "l http",
        "wifi",
        "wifi access",
        "wifi hotspot",
        "wifi internet",
        "southwest wifi",
        "inflight",
        "inflight entertainment",
        "southwest",
        "comedy",
        "internet",
        "strong",
        "drama",
        "google chrome",
        "business select",
        "internet access",
        "apple safari",
        "book",
        "rapid",
        "love",
        "summer",
        "poppy",
        "floyd",
        "district",
        "jackson",
        "kevin",
        "live",
        "music",
        "upgrade",
        "gift",
        "lost",
        "carol",
        "canada",
        "cobalt strike",
        "malicious",
        "fragtor",
        "phishing paypal",
        "mail spammer"
      ],
      "references": [
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Self whitelisting tool, domains moved within nginx."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Bulz",
          "display_name": "Bulz",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Fragtor",
          "display_name": "Fragtor",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 60,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8753,
        "domain": 1525,
        "hostname": 3740,
        "FileHash-SHA256": 6746,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 509,
        "SSLCertFingerprint": 3,
        "CVE": 8,
        "CIDR": 5,
        "email": 7
      },
      "indicator_count": 21915,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "737 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659d687f92ebb4f3d613ae0c",
      "name": "Mimikatz | www.ssc.spaceforce.mil ",
      "description": "",
      "modified": "2024-01-09T15:38:39.547000",
      "created": "2024-01-09T15:38:39.547000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655cd0f065d2e5a6c92369e5",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "832 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656aa27f81a9096f5889a9d0",
      "name": "WebToolbar | www.ssc.spaceforce.mil ",
      "description": "",
      "modified": "2023-12-21T15:00:07.190000",
      "created": "2023-12-02T03:20:31.494000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655cd0f065d2e5a6c92369e5",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "851 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655ce5116519bd86d1f1bdee",
      "name": "FormBook | www.ssc.spaceforce.mil 'Hoax' | Spyware | Fraud Services",
      "description": "",
      "modified": "2023-12-21T15:00:07.190000",
      "created": "2023-11-21T17:12:49.783000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "851 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655cd0f065d2e5a6c92369e5",
      "name": "www.ssc.spaceforce.mil",
      "description": "",
      "modified": "2023-12-21T15:00:07.190000",
      "created": "2023-11-21T15:46:56.740000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "851 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65403022038832e42175601f",
      "name": "CRITICAL!!! | Health Insurance Cyber threat Matrix - Darkside 2020 Ecosystem .BEware ",
      "description": "",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-30T22:37:22.425000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": "65402a8dec948bec8b0a0372",
      "export_count": 95,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 8601,
        "URL": 7499,
        "domain": 4604,
        "hostname": 4187,
        "CIDR": 2,
        "CVE": 23,
        "URI": 1
      },
      "indicator_count": 25942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "873 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6544cbbca7610e92e4262c47",
      "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Targeting",
      "description": "",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-11-03T10:30:20.965000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": "654140bae73f795aa914e8de",
      "export_count": 108,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "873 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "654140bae73f795aa914e8de",
      "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears",
      "description": "",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-31T18:00:26.439000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": "65401d73e96dd70037ed22a7",
      "export_count": 98,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "873 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65401d5ee5a7359a5e815a6a",
      "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
      "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-30T21:17:18.712000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "873 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://kolejnik.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://kolejnik.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776716059.8659334
}