{
  "type": "URL",
  "indicator": "https://login.partner.microsoftonline.cn/.%",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://login.partner.microsoftonline.cn/.%",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3752891792,
      "indicator": "https://login.partner.microsoftonline.cn/.%",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 26,
      "pulses": [
        {
          "id": "6570a8e51a92ae866818d432",
          "name": "Apple link - Critical risk found",
          "description": "",
          "modified": "2023-12-06T17:01:25.538000",
          "created": "2023-12-06T17:01:25.538000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1090,
            "URL": 866,
            "hostname": 581,
            "domain": 101,
            "FileHash-MD5": 72,
            "FileHash-SHA1": 63
          },
          "indicator_count": 2773,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8e11f1fc3b551c19f8d",
          "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
          "description": "",
          "modified": "2023-12-06T17:01:21.406000",
          "created": "2023-12-06T17:01:21.406000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 210,
            "hostname": 242,
            "domain": 87,
            "URL": 506,
            "FileHash-MD5": 21,
            "FileHash-SHA1": 13
          },
          "indicator_count": 1079,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8ddf417154b2bfc3446",
          "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
          "description": "",
          "modified": "2023-12-06T17:01:17.482000",
          "created": "2023-12-06T17:01:17.482000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 210,
            "hostname": 242,
            "domain": 87,
            "URL": 506,
            "FileHash-MD5": 21,
            "FileHash-SHA1": 13
          },
          "indicator_count": 1079,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8d9de9710087f6f91b3",
          "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
          "description": "",
          "modified": "2023-12-06T17:01:13.202000",
          "created": "2023-12-06T17:01:13.202000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1090,
            "hostname": 427,
            "domain": 89,
            "URL": 545,
            "FileHash-MD5": 72,
            "FileHash-SHA1": 63
          },
          "indicator_count": 2286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8d167202b93ee502ff8",
          "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
          "description": "",
          "modified": "2023-12-06T17:01:05.291000",
          "created": "2023-12-06T17:01:05.291000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 12,
            "URL": 3839,
            "hostname": 1331,
            "FileHash-SHA256": 2976,
            "domain": 757,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 80
          },
          "indicator_count": 9245,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a857cae685fce7f5231e",
          "name": "Phishing - bam-cell.cell.nr-data.net",
          "description": "",
          "modified": "2023-12-06T16:59:03.209000",
          "created": "2023-12-06T16:59:03.209000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 2052,
            "hostname": 1185,
            "domain": 460,
            "URL": 4294,
            "FileHash-MD5": 10,
            "FileHash-SHA1": 11
          },
          "indicator_count": 8013,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a81314a587dca8a7e075",
          "name": "Blackshades  | Remote attacks | Malicious Google Search | DNS Requests",
          "description": "",
          "modified": "2023-12-06T16:57:55.292000",
          "created": "2023-12-06T16:57:55.292000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1407,
            "hostname": 557,
            "domain": 226,
            "FileHash-MD5": 860,
            "FileHash-SHA1": 488,
            "URL": 589
          },
          "indicator_count": 4127,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a80d15fdb40571638038",
          "name": "Blackshades  | Remote attacks | Malicious Google Search | DNS Requests",
          "description": "",
          "modified": "2023-12-06T16:57:49.914000",
          "created": "2023-12-06T16:57:49.914000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1407,
            "hostname": 557,
            "domain": 226,
            "FileHash-MD5": 860,
            "FileHash-SHA1": 488,
            "URL": 589
          },
          "indicator_count": 4127,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a97db9134b17c1f6d845b",
          "name": "DeepScan:Generic.Ransom.GandCrab5",
          "description": "",
          "modified": "2023-12-02T02:35:07.890000",
          "created": "2023-12-02T02:35:07.890000",
          "tags": [
            "cisco umbrella",
            "site",
            "safe site",
            "detection list",
            "blacklist",
            "million",
            "malicious url",
            "maltiverse",
            "heuristic",
            "redirme",
            "exploit",
            "malware",
            "team",
            "microsoft",
            "urlhttps",
            "blacklist https",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "hacktool",
            "arkeistealer",
            "mail spammer",
            "united",
            "germany",
            "opencandy",
            "proxy",
            "firehol",
            "alexa top",
            "phishing site",
            "malicious site",
            "malware site",
            "alexa",
            "phishing",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "riskware",
            "unsafe",
            "artemis",
            "bank",
            "cve201711882",
            "tag count",
            "cyber threat",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "pragma",
            "contacted urls",
            "ssl certificate",
            "whois record",
            "xmodeargs",
            "whois whois",
            "xdpid1203",
            "xpubid10839",
            "september",
            "tsara brashears",
            "collection",
            "emotet",
            "malicious",
            "critical",
            "copy",
            "installer",
            "banker",
            "keylogger",
            "heur",
            "filerepmetagen",
            "suspected",
            "adware",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "filetour",
            "cleaner",
            "conduit",
            "wacatac",
            "trojanspy",
            "webtoolbar"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6541df216e018a0bce63e2a3",
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2559,
            "CVE": 6,
            "FileHash-MD5": 582,
            "FileHash-SHA1": 353,
            "FileHash-SHA256": 3232,
            "hostname": 826,
            "domain": 206,
            "URI": 1
          },
          "indicator_count": 7765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "912 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6541df216e018a0bce63e2a3",
          "name": "DeepScan:Generic.Ransom.GandCrab5",
          "description": "Malicious redirect. OWA? Dreaded Canary cookie? I don't know yet. Link affects individuals, corporations and edu's. \n\n{*https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic\n*Redirects to: https://login.microsoftonline.com/jsdisabled}\n(AUTO POPULATED: A full list of findings from the Maltiverse Research Team on Malware and Exploit, as compiled by the National Security Agency (NSA), has been published on the website of Microsoft's website.)",
          "modified": "2023-12-01T04:05:20.963000",
          "created": "2023-11-01T05:16:17.835000",
          "tags": [
            "cisco umbrella",
            "site",
            "safe site",
            "detection list",
            "blacklist",
            "million",
            "malicious url",
            "maltiverse",
            "heuristic",
            "redirme",
            "exploit",
            "malware",
            "team",
            "microsoft",
            "urlhttps",
            "blacklist https",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "hacktool",
            "arkeistealer",
            "mail spammer",
            "united",
            "germany",
            "opencandy",
            "proxy",
            "firehol",
            "alexa top",
            "phishing site",
            "malicious site",
            "malware site",
            "alexa",
            "phishing",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "riskware",
            "unsafe",
            "artemis",
            "bank",
            "cve201711882",
            "tag count",
            "cyber threat",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "pragma",
            "contacted urls",
            "ssl certificate",
            "whois record",
            "xmodeargs",
            "whois whois",
            "xdpid1203",
            "xpubid10839",
            "september",
            "tsara brashears",
            "collection",
            "emotet",
            "malicious",
            "critical",
            "copy",
            "installer",
            "banker",
            "keylogger",
            "heur",
            "filerepmetagen",
            "suspected",
            "adware",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "filetour",
            "cleaner",
            "conduit",
            "wacatac",
            "trojanspy",
            "webtoolbar"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2559,
            "CVE": 6,
            "FileHash-MD5": 582,
            "FileHash-SHA1": 353,
            "FileHash-SHA256": 3232,
            "hostname": 826,
            "domain": 206,
            "URI": 1
          },
          "indicator_count": 7765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "912 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6545a25d60272bac5827f2fc",
          "name": "TrojanSpy",
          "description": "",
          "modified": "2023-12-01T04:05:20.963000",
          "created": "2023-11-04T01:46:05.174000",
          "tags": [
            "cisco umbrella",
            "site",
            "safe site",
            "detection list",
            "blacklist",
            "million",
            "malicious url",
            "maltiverse",
            "heuristic",
            "redirme",
            "exploit",
            "malware",
            "team",
            "microsoft",
            "urlhttps",
            "blacklist https",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "hacktool",
            "arkeistealer",
            "mail spammer",
            "united",
            "germany",
            "opencandy",
            "proxy",
            "firehol",
            "alexa top",
            "phishing site",
            "malicious site",
            "malware site",
            "alexa",
            "phishing",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "riskware",
            "unsafe",
            "artemis",
            "bank",
            "cve201711882",
            "tag count",
            "cyber threat",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "pragma",
            "contacted urls",
            "ssl certificate",
            "whois record",
            "xmodeargs",
            "whois whois",
            "xdpid1203",
            "xpubid10839",
            "september",
            "tsara brashears",
            "collection",
            "emotet",
            "malicious",
            "critical",
            "copy",
            "installer",
            "banker",
            "keylogger",
            "heur",
            "filerepmetagen",
            "suspected",
            "adware",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "filetour",
            "cleaner",
            "conduit",
            "wacatac",
            "trojanspy",
            "webtoolbar"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6541e08c81e836438946bbbf",
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2559,
            "CVE": 6,
            "FileHash-MD5": 582,
            "FileHash-SHA1": 353,
            "FileHash-SHA256": 3232,
            "hostname": 826,
            "domain": 206,
            "URI": 1
          },
          "indicator_count": 7765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "912 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6543350c86e1299dc78bfa90",
          "name": "this dick",
          "description": "",
          "modified": "2023-12-01T04:05:20.963000",
          "created": "2023-11-02T05:35:08.226000",
          "tags": [
            "cisco umbrella",
            "site",
            "safe site",
            "detection list",
            "blacklist",
            "million",
            "malicious url",
            "maltiverse",
            "heuristic",
            "redirme",
            "exploit",
            "malware",
            "team",
            "microsoft",
            "urlhttps",
            "blacklist https",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "hacktool",
            "arkeistealer",
            "mail spammer",
            "united",
            "germany",
            "opencandy",
            "proxy",
            "firehol",
            "alexa top",
            "phishing site",
            "malicious site",
            "malware site",
            "alexa",
            "phishing",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "riskware",
            "unsafe",
            "artemis",
            "bank",
            "cve201711882",
            "tag count",
            "cyber threat",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "pragma",
            "contacted urls",
            "ssl certificate",
            "whois record",
            "xmodeargs",
            "whois whois",
            "xdpid1203",
            "xpubid10839",
            "september",
            "tsara brashears",
            "collection",
            "emotet",
            "malicious",
            "critical",
            "copy",
            "installer",
            "banker",
            "keylogger",
            "heur",
            "filerepmetagen",
            "suspected",
            "adware",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "filetour",
            "cleaner",
            "conduit",
            "wacatac",
            "trojanspy",
            "webtoolbar"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6541df216e018a0bce63e2a3",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Nicholus33",
            "id": "76046",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2559,
            "CVE": 6,
            "FileHash-MD5": 582,
            "FileHash-SHA1": 353,
            "FileHash-SHA256": 3232,
            "hostname": 826,
            "domain": 207,
            "URI": 1
          },
          "indicator_count": 7766,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 2,
          "modified_text": "912 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6541e08c81e836438946bbbf",
          "name": "TrojanSpy",
          "description": "Malicious redirect.  Targets individual.\n{*https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic\n*Redirects to: https://login.microsoftonline.com/jsdisabled}\n(AUTO POPULATED: A full list of findings from the Maltiverse Research Team on Malware and Exploit, as compiled by the National Security Agency (NSA), has been published on the website of Microsoft's website.)",
          "modified": "2023-12-01T04:05:20.963000",
          "created": "2023-11-01T05:22:20.519000",
          "tags": [
            "cisco umbrella",
            "site",
            "safe site",
            "detection list",
            "blacklist",
            "million",
            "malicious url",
            "maltiverse",
            "heuristic",
            "redirme",
            "exploit",
            "malware",
            "team",
            "microsoft",
            "urlhttps",
            "blacklist https",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "hacktool",
            "arkeistealer",
            "mail spammer",
            "united",
            "germany",
            "opencandy",
            "proxy",
            "firehol",
            "alexa top",
            "phishing site",
            "malicious site",
            "malware site",
            "alexa",
            "phishing",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "riskware",
            "unsafe",
            "artemis",
            "bank",
            "cve201711882",
            "tag count",
            "cyber threat",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "pragma",
            "contacted urls",
            "ssl certificate",
            "whois record",
            "xmodeargs",
            "whois whois",
            "xdpid1203",
            "xpubid10839",
            "september",
            "tsara brashears",
            "collection",
            "emotet",
            "malicious",
            "critical",
            "copy",
            "installer",
            "banker",
            "keylogger",
            "heur",
            "filerepmetagen",
            "suspected",
            "adware",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "filetour",
            "cleaner",
            "conduit",
            "wacatac",
            "trojanspy",
            "webtoolbar"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2559,
            "CVE": 6,
            "FileHash-MD5": 582,
            "FileHash-SHA1": 353,
            "FileHash-SHA256": 3232,
            "hostname": 826,
            "domain": 206,
            "URI": 1
          },
          "indicator_count": 7765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "912 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1a3a03614354a606c383",
          "name": "Apple - Malicious activities found in iOS link | verified cyber criminal",
          "description": "",
          "modified": "2023-11-13T04:04:31.274000",
          "created": "2023-10-30T02:51:38.882000",
          "tags": [
            "pattern match",
            "script",
            "beginstring",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "ck matrix",
            "indicator",
            "ascii text",
            "date",
            "null",
            "unknown",
            "error",
            "span",
            "class",
            "critical",
            "refresh",
            "body",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "meta",
            "http response",
            "final url",
            "serving ip",
            "address",
            "name verdict",
            "falcon sandbox",
            "detection list",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6529abecabb0de583aad0aa3",
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 707,
            "FileHash-MD5": 276,
            "FileHash-SHA1": 263,
            "FileHash-SHA256": 4615,
            "domain": 108,
            "hostname": 1292
          },
          "indicator_count": 7261,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "930 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6529abecabb0de583aad0aa3",
          "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
          "description": "Very curious issue found in previous pulse.\nCyber warfare.\nUnspecified legal entities & verified cyber criminals?\nWorking together? Unverified.\ntargets:\ntsara brashears - verified\nsong culture - verified\nkedence - verified\nSkype - verified\nmessages - verified\napple iTunes - verified\nCVE? Pay me.\nInvolves legal entities targeting an individual, business and associates after an alleged physical SA attack of a female according to published sources. \nAppears to be silencing. Overwhelming amount of  threats found online.\n\nTests calls tracking me now\nD241 test successful/ DOS/ hacker initiated.\nSilencing me now. Verifiable\nRed Teams, attorneys, verified cyber criminals,  IC3 China IP. Malicious\nIP origination appears to be US. Bounces.\nNeeds further research.",
          "modified": "2023-11-13T04:04:31.274000",
          "created": "2023-10-13T20:43:24.771000",
          "tags": [
            "pattern match",
            "script",
            "beginstring",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "ck matrix",
            "indicator",
            "ascii text",
            "date",
            "null",
            "unknown",
            "error",
            "span",
            "class",
            "critical",
            "refresh",
            "body",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "meta",
            "http response",
            "final url",
            "serving ip",
            "address",
            "name verdict",
            "falcon sandbox",
            "detection list",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 707,
            "FileHash-MD5": 276,
            "FileHash-SHA1": 263,
            "FileHash-SHA256": 4615,
            "domain": 108,
            "hostname": 1292
          },
          "indicator_count": 7261,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "930 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1c14640441b2e0b7ec5e",
          "name": "Apple link - Critical risk found",
          "description": "",
          "modified": "2023-11-13T03:03:18.483000",
          "created": "2023-10-30T02:59:32.811000",
          "tags": [
            "pattern match",
            "script",
            "beginstring",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "ck matrix",
            "indicator",
            "ascii text",
            "date",
            "null",
            "unknown",
            "error",
            "span",
            "class",
            "critical",
            "refresh",
            "body",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "meta",
            "http response",
            "final url",
            "serving ip",
            "address",
            "name verdict",
            "falcon sandbox",
            "detection list",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6529ac30efd59e5ff6f5f709",
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2291,
            "FileHash-MD5": 225,
            "FileHash-SHA1": 213,
            "FileHash-SHA256": 3746,
            "domain": 159,
            "hostname": 1922
          },
          "indicator_count": 8556,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "931 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6529ac30efd59e5ff6f5f709",
          "name": "Apple link - Critical risk found ",
          "description": "",
          "modified": "2023-11-13T03:03:18.483000",
          "created": "2023-10-13T20:44:32.429000",
          "tags": [
            "pattern match",
            "script",
            "beginstring",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "ck matrix",
            "indicator",
            "ascii text",
            "date",
            "null",
            "unknown",
            "error",
            "span",
            "class",
            "critical",
            "refresh",
            "body",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "meta",
            "http response",
            "final url",
            "serving ip",
            "address",
            "name verdict",
            "falcon sandbox",
            "detection list",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6529abecabb0de583aad0aa3",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2291,
            "FileHash-MD5": 225,
            "FileHash-SHA1": 213,
            "FileHash-SHA256": 3746,
            "domain": 159,
            "hostname": 1922
          },
          "indicator_count": 8556,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "931 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6529abf05c98d1f861b4f5c2",
          "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
          "description": "Very curious issue found in previous pulse.\nCyber warfare.\nUnspecified legal entities & verified cyber criminals?\nWorking together? Unverified.\ntargets:\ntsara brashears - verified\nsong culture - verified\nkedence - verified\nSkype - verified\nmessages - verified\napple iTunes - verified\nCVE? Pay me.\nInvolves legal entities targeting an individual, business and associates after an alleged physical SA attack of a female according to published sources. \nAppears to be silencing. Overwhelming amount of  threats found online.\n\nTests calls tracking me now\nD241 test successful/ DOS/ hacker initiated.\nSilencing me now. Verifiable\nRed Teams, attorneys, verified cyber criminals,  IC3 China IP. Malicious\nIP origination appears to be US. Bounces.\nNeeds further research.",
          "modified": "2023-11-12T20:00:47.471000",
          "created": "2023-10-13T20:43:28.475000",
          "tags": [
            "pattern match",
            "script",
            "beginstring",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "ck matrix",
            "indicator",
            "ascii text",
            "date",
            "null",
            "unknown",
            "error",
            "span",
            "class",
            "critical",
            "refresh",
            "body",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "meta",
            "http response",
            "final url",
            "serving ip",
            "address",
            "name verdict",
            "falcon sandbox",
            "detection list",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 506,
            "FileHash-MD5": 21,
            "FileHash-SHA1": 13,
            "FileHash-SHA256": 210,
            "domain": 87,
            "hostname": 242
          },
          "indicator_count": 1079,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "931 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6529abeea42ff162d737873d",
          "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
          "description": "Very curious issue found in previous pulse.\nCyber warfare.\nUnspecified legal entities & verified cyber criminals?\nWorking together? Unverified.\ntargets:\ntsara brashears - verified\nsong culture - verified\nkedence - verified\nSkype - verified\nmessages - verified\napple iTunes - verified\nCVE? Pay me.\nInvolves legal entities targeting an individual, business and associates after an alleged physical SA attack of a female according to published sources. \nAppears to be silencing. Overwhelming amount of  threats found online.\n\nTests calls tracking me now\nD241 test successful/ DOS/ hacker initiated.\nSilencing me now. Verifiable\nRed Teams, attorneys, verified cyber criminals,  IC3 China IP. Malicious\nIP origination appears to be US. Bounces.\nNeeds further research.",
          "modified": "2023-11-12T20:00:47.471000",
          "created": "2023-10-13T20:43:26.158000",
          "tags": [
            "pattern match",
            "script",
            "beginstring",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "ck matrix",
            "indicator",
            "ascii text",
            "date",
            "null",
            "unknown",
            "error",
            "span",
            "class",
            "critical",
            "refresh",
            "body",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "meta",
            "http response",
            "final url",
            "serving ip",
            "address",
            "name verdict",
            "falcon sandbox",
            "detection list",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 506,
            "FileHash-MD5": 21,
            "FileHash-SHA1": 13,
            "FileHash-SHA256": 210,
            "domain": 87,
            "hostname": 242
          },
          "indicator_count": 1079,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "931 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f19f703614354a606c382",
          "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
          "description": "",
          "modified": "2023-11-12T17:01:15.222000",
          "created": "2023-10-30T02:50:31.950000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "communicating",
            "unlocker",
            "legal entities",
            "using ip",
            "amazon aws",
            "apple ios",
            "passcode",
            "attack",
            "verified",
            "cyber criminal",
            "name verdict",
            "falcon sandbox",
            "united",
            "flag",
            "date",
            "name server",
            "markmonitor",
            "contains",
            "external",
            "new relic",
            "logo",
            "av detection",
            "hybrid",
            "general",
            "click",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "proxy",
            "firehol",
            "malware",
            "heur",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "malicious site",
            "malware site",
            "adware",
            "artemis",
            "iframe",
            "cleaner",
            "unsafe",
            "riskware",
            "opencandy",
            "downldr",
            "nircmd",
            "swrort",
            "presenoker",
            "wacatac",
            "phishing",
            "xtrat",
            "crack",
            "tiggre",
            "exploit",
            "agent",
            "filetour",
            "conduit",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "softcnapp",
            "fusioncore",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "xrat",
            "gamehack",
            "webtoolbar",
            "trojanspy",
            "maltiverse",
            "urls",
            "detection list",
            "blacklist https",
            "path",
            "maxage31536000",
            "expiressat",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "pragma",
            "html info",
            "title kedence",
            "official apk",
            "meta tags",
            "apk download",
            "android",
            "google tag",
            "utc google",
            "utc na",
            "phishing site",
            "anonymizer",
            "malicious host",
            "driverpack",
            "ransomware",
            "installcore",
            "suppobox",
            "patcher",
            "generic",
            "dropper",
            "fakealert",
            "quasar rat",
            "applicunwnt",
            "mimikatz",
            "team",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "Cyber Criminal",
              "display_name": "Cyber Criminal",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65298a6839a49a9aa732bcac",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 250,
            "FileHash-SHA1": 80,
            "FileHash-SHA256": 2976,
            "domain": 757,
            "hostname": 1331,
            "URL": 3839,
            "CVE": 12
          },
          "indicator_count": 9245,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "931 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65298a6839a49a9aa732bcac",
          "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
          "description": "IC3 attached to links, apple , messaging, Skype.\nIC3 CN?\nChina? Unclear. Possibly intercepting  IC3 complaints or linking to FBI to frame targets. Links show attack is Attorney orchestrated. \nSame group of Apple iTune links affected by Java.Trojan.GenericGB, Apple NetWorm Trojan.Buzus, Dropper.Mudrop, GenPack:Trojan.Generic, Worm.Mytob ,Phishing site, Anonymizer , netsky ,worm and other vulnerabilities over time. \u200eSign of the Times \u2013 Album par Dembiak Music \u2013 Apple Music Autonomous Systems: AS714 Apple Inc AS14061 Digital Ocean Inc AS8560 1 1 Internet SE Anonymizer: Proxy - FireHol malicious url, evasive, pua, worm, network, attack, bad actor, targeting",
          "modified": "2023-11-12T17:01:15.222000",
          "created": "2023-10-13T18:20:24.042000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "communicating",
            "unlocker",
            "legal entities",
            "using ip",
            "amazon aws",
            "apple ios",
            "passcode",
            "attack",
            "verified",
            "cyber criminal",
            "name verdict",
            "falcon sandbox",
            "united",
            "flag",
            "date",
            "name server",
            "markmonitor",
            "contains",
            "external",
            "new relic",
            "logo",
            "av detection",
            "hybrid",
            "general",
            "click",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "proxy",
            "firehol",
            "malware",
            "heur",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "malicious site",
            "malware site",
            "adware",
            "artemis",
            "iframe",
            "cleaner",
            "unsafe",
            "riskware",
            "opencandy",
            "downldr",
            "nircmd",
            "swrort",
            "presenoker",
            "wacatac",
            "phishing",
            "xtrat",
            "crack",
            "tiggre",
            "exploit",
            "agent",
            "filetour",
            "conduit",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "softcnapp",
            "fusioncore",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "xrat",
            "gamehack",
            "webtoolbar",
            "trojanspy",
            "maltiverse",
            "urls",
            "detection list",
            "blacklist https",
            "path",
            "maxage31536000",
            "expiressat",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "pragma",
            "html info",
            "title kedence",
            "official apk",
            "meta tags",
            "apk download",
            "android",
            "google tag",
            "utc google",
            "utc na",
            "phishing site",
            "anonymizer",
            "malicious host",
            "driverpack",
            "ransomware",
            "installcore",
            "suppobox",
            "patcher",
            "generic",
            "dropper",
            "fakealert",
            "quasar rat",
            "applicunwnt",
            "mimikatz",
            "team",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "Cyber Criminal",
              "display_name": "Cyber Criminal",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 250,
            "FileHash-SHA1": 80,
            "FileHash-SHA256": 2976,
            "domain": 757,
            "hostname": 1331,
            "URL": 3839,
            "CVE": 12
          },
          "indicator_count": 9245,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "931 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f155cf81da97fd82bba62",
          "name": "Phishing - bam-cell.cell.nr-data.net",
          "description": "",
          "modified": "2023-11-09T05:05:01.692000",
          "created": "2023-10-30T02:30:52.720000",
          "tags": [
            "whois record",
            "contacted",
            "ssl certificate",
            "parent",
            "historical ssl",
            "communicating",
            "siblings",
            "execution",
            "resolutions",
            "collections",
            "malicious",
            "generic malware",
            "hybridanalysis",
            "fri jan",
            "mon jan",
            "date filename",
            "blacklist fri",
            "install league",
            "legends",
            "fri dec",
            "sun jan",
            "allusersprofile",
            "osuser",
            "dns requests",
            "process list",
            "gamesmetadata",
            "cisco umbrella",
            "site",
            "mon jul",
            "online thu",
            "safe site",
            "malware",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "inc validity",
            "relic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6524f2a85b4dd064922b8c7a",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4294,
            "FileHash-MD5": 10,
            "FileHash-SHA1": 11,
            "FileHash-SHA256": 2052,
            "domain": 460,
            "hostname": 1185,
            "CVE": 1
          },
          "indicator_count": 8013,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "934 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6524f2a85b4dd064922b8c7a",
          "name": "Phishing - bam-cell.cell.nr-data.net",
          "description": "Phishing\nAPT's\nAnonymization\nProxy: FireHOL\ncloud collector-newrelic\nG0032 - Lazarus Group 03/2023\nAS23467 New Relic",
          "modified": "2023-11-09T05:05:01.692000",
          "created": "2023-10-10T06:43:52.526000",
          "tags": [
            "whois record",
            "contacted",
            "ssl certificate",
            "parent",
            "historical ssl",
            "communicating",
            "siblings",
            "execution",
            "resolutions",
            "collections",
            "malicious",
            "generic malware",
            "hybridanalysis",
            "fri jan",
            "mon jan",
            "date filename",
            "blacklist fri",
            "install league",
            "legends",
            "fri dec",
            "sun jan",
            "allusersprofile",
            "osuser",
            "dns requests",
            "process list",
            "gamesmetadata",
            "cisco umbrella",
            "site",
            "mon jul",
            "online thu",
            "safe site",
            "malware",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "inc validity",
            "relic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4294,
            "FileHash-MD5": 10,
            "FileHash-SHA1": 11,
            "FileHash-SHA256": 2052,
            "domain": 460,
            "hostname": 1185,
            "CVE": 1
          },
          "indicator_count": 8013,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "934 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6520e6e8396ce5b825a4edb9",
          "name": "Blackshades  | Remote attacks | Malicious Google Search | DNS Requests",
          "description": "Botnet Command and Control \nCobalt Strike\nMisc Attack\nHidden users\nTargets: network, communication, devices, url, music publishing company, artists, owner, associates, advertising, visibility, reputations, digital profile.\nCountry origination: United States",
          "modified": "2023-11-06T03:00:36.709000",
          "created": "2023-10-07T05:04:40.671000",
          "tags": [
            "noname057",
            "song culture",
            "brashears music",
            "culture",
            "tsara lynn",
            "falcon sandbox",
            "brashears song",
            "nights",
            "kedence",
            "service",
            "sandbox",
            "cool",
            "music",
            "secure",
            "httponly",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "united",
            "flag",
            "contacted",
            "emotet",
            "NSIS",
            "trellian",
            "apple",
            "apk",
            "os",
            "ios",
            "android",
            "google",
            "Google search",
            "dns",
            "query",
            "poisoning",
            "hacking",
            "injection",
            "login",
            "logon",
            "phishing",
            "scanning_host",
            "VM",
            "file query",
            "detect",
            "windir",
            "api call",
            "api",
            "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call",
            "\"iexplore.exe\" trying to touch file",
            "attack",
            "target",
            "jeffrey",
            "reimer",
            "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v",
            "suricata",
            "alert",
            "cyber threat",
            "dpt",
            "porn",
            "pixelrz",
            "dead",
            "hifi",
            "track",
            "jeffrey reimer dpt",
            "redirect",
            "pattern match",
            "tbmisch",
            "contentlength",
            "mcfunction",
            "ck id",
            "t1071",
            "mitre att",
            "ck matrix",
            "drops",
            "content reputation",
            "malware",
            "malvertizing",
            "misc attack",
            "mitre",
            "file access",
            "files marked clean",
            "evasive",
            "cisco umbrella",
            "safe site",
            "site",
            "windows nt",
            "file",
            "network related",
            "https webserver",
            "getpost",
            "get search",
            "geckohost",
            "jpeg image",
            "jfif",
            "png image",
            "gif image",
            "binary file",
            "t1105",
            "show technique",
            "click",
            "blacklist",
            "generic malware",
            "DNS Requests",
            "persistence",
            "gmt0600",
            "programfiles",
            "filename",
            "indexed",
            "network",
            "hosts process",
            "openurl c",
            "prefetch2 name",
            "ssl certificate",
            "whois record",
            "threat roundup",
            "execution",
            "march",
            "july",
            "communicating",
            "october",
            "september",
            "referrer",
            "june",
            "april",
            "august",
            "copy",
            "goldfinder",
            "sibot",
            "hacktool",
            "february",
            "skynet",
            "malicious",
            "download",
            "malware",
            "relic",
            "monitoring",
            "installer",
            "project",
            "core",
            "lumma stealer",
            "metro",
            "Anonymizer",
            "virut",
            "scanning ip's",
            "Cobalt Strike",
            "keybase",
            "spam",
            "anonymisation services",
            "malicious host",
            "Botnet Command and Control",
            "Phishing - Mr.Looquer",
            "covid19 scam",
            "social engineering",
            "Jumpseller phishing",
            "phishing: Amazon.com",
            "unauthorized scanning of hosts",
            "phishing huntington bank",
            "malicious url",
            "malicious server",
            "Threats200220200050",
            "ntp open resolver",
            "blackshades",
            "infostealer",
            "rat",
            "infinity",
            "msil",
            "adware",
            "adload",
            "gamarue",
            "pua",
            "keyloggers",
            "browser malware",
            "resolutions",
            "whois whois",
            "historical ssl",
            "subdomains",
            "whois siblings",
            "bradesco",
            "paypal phishing",
            "bad traffic",
            "Yandex",
            "hidden users"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/",
            "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears",
            "Research and Data analysis",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer No Expiration http://pixelrz.com/lists/keywords/tsara-brashears-dead",
            "http://pixelrz.com/lists/keywords/tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn",
            "DNS Server - Public-dns.info",
            "Autonomous System",
            "AS13414 Twitter Inc",
            "AS32934 Facebook Inc",
            "AS15133 MCI Communications Services Inc d b a Verizon Business",
            "AS13335 - Cloudflare, Inc.  - United States",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn",
            "https://amp.hifiporn.cc/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati",
            "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati"
          ],
          "public": 1,
          "adversary": "[Miscellaneous, Unnamed]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Gen:Trojan.Heur",
              "display_name": "Gen:Trojan.Heur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Emotet - S0367",
              "display_name": "Emotet - S0367",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "GoldFinder - S0597",
              "display_name": "GoldFinder - S0597",
              "target": null
            },
            {
              "id": "BlackShades Crypter",
              "display_name": "BlackShades Crypter",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [
            "Media",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 860,
            "FileHash-SHA1": 488,
            "FileHash-SHA256": 1407,
            "domain": 226,
            "hostname": 557,
            "URL": 589
          },
          "indicator_count": 4127,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "938 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1dd94c3c9a46abe24f02",
          "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests",
          "description": "",
          "modified": "2023-11-06T03:00:36.709000",
          "created": "2023-10-30T03:07:05.227000",
          "tags": [
            "noname057",
            "song culture",
            "brashears music",
            "culture",
            "tsara lynn",
            "falcon sandbox",
            "brashears song",
            "nights",
            "kedence",
            "service",
            "sandbox",
            "cool",
            "music",
            "secure",
            "httponly",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "united",
            "flag",
            "contacted",
            "emotet",
            "NSIS",
            "trellian",
            "apple",
            "apk",
            "os",
            "ios",
            "android",
            "google",
            "Google search",
            "dns",
            "query",
            "poisoning",
            "hacking",
            "injection",
            "login",
            "logon",
            "phishing",
            "scanning_host",
            "VM",
            "file query",
            "detect",
            "windir",
            "api call",
            "api",
            "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call",
            "\"iexplore.exe\" trying to touch file",
            "attack",
            "target",
            "jeffrey",
            "reimer",
            "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v",
            "suricata",
            "alert",
            "cyber threat",
            "dpt",
            "porn",
            "pixelrz",
            "dead",
            "hifi",
            "track",
            "jeffrey reimer dpt",
            "redirect",
            "pattern match",
            "tbmisch",
            "contentlength",
            "mcfunction",
            "ck id",
            "t1071",
            "mitre att",
            "ck matrix",
            "drops",
            "content reputation",
            "malware",
            "malvertizing",
            "misc attack",
            "mitre",
            "file access",
            "files marked clean",
            "evasive",
            "cisco umbrella",
            "safe site",
            "site",
            "windows nt",
            "file",
            "network related",
            "https webserver",
            "getpost",
            "get search",
            "geckohost",
            "jpeg image",
            "jfif",
            "png image",
            "gif image",
            "binary file",
            "t1105",
            "show technique",
            "click",
            "blacklist",
            "generic malware",
            "DNS Requests",
            "persistence",
            "gmt0600",
            "programfiles",
            "filename",
            "indexed",
            "network",
            "hosts process",
            "openurl c",
            "prefetch2 name",
            "ssl certificate",
            "whois record",
            "threat roundup",
            "execution",
            "march",
            "july",
            "communicating",
            "october",
            "september",
            "referrer",
            "june",
            "april",
            "august",
            "copy",
            "goldfinder",
            "sibot",
            "hacktool",
            "february",
            "skynet",
            "malicious",
            "download",
            "malware",
            "relic",
            "monitoring",
            "installer",
            "project",
            "core",
            "lumma stealer",
            "metro",
            "Anonymizer",
            "virut",
            "scanning ip's",
            "Cobalt Strike",
            "keybase",
            "spam",
            "anonymisation services",
            "malicious host",
            "Botnet Command and Control",
            "Phishing - Mr.Looquer",
            "covid19 scam",
            "social engineering",
            "Jumpseller phishing",
            "phishing: Amazon.com",
            "unauthorized scanning of hosts",
            "phishing huntington bank",
            "malicious url",
            "malicious server",
            "Threats200220200050",
            "ntp open resolver",
            "blackshades",
            "infostealer",
            "rat",
            "infinity",
            "msil",
            "adware",
            "adload",
            "gamarue",
            "pua",
            "keyloggers",
            "browser malware",
            "resolutions",
            "whois whois",
            "historical ssl",
            "subdomains",
            "whois siblings",
            "bradesco",
            "paypal phishing",
            "bad traffic",
            "Yandex",
            "hidden users"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/",
            "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears",
            "Research and Data analysis",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://pixelrz.com/lists/keywords/tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn",
            "DNS Server - Public-dns.info",
            "Autonomous System",
            "AS13414 Twitter Inc",
            "AS32934 Facebook Inc",
            "AS15133 MCI Communications Services Inc d b a Verizon Business",
            "AS13335 - Cloudflare, Inc.  - United States",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn",
            "wTools",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke"
          ],
          "public": 1,
          "adversary": "[Miscellaneous, Unnamed]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Gen:Trojan.Heur",
              "display_name": "Gen:Trojan.Heur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Emotet - S0367",
              "display_name": "Emotet - S0367",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "GoldFinder - S0597",
              "display_name": "GoldFinder - S0597",
              "target": null
            },
            {
              "id": "BlackShades Crypter",
              "display_name": "BlackShades Crypter",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [
            "Media",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": "6520e93e8cf8f83a2ccfd46b",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 860,
            "FileHash-SHA1": 488,
            "FileHash-SHA256": 1407,
            "domain": 226,
            "hostname": 557,
            "URL": 589
          },
          "indicator_count": 4127,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "938 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6520e93e8cf8f83a2ccfd46b",
          "name": "Blackshades  | Remote attacks | Malicious Google Search | DNS Requests",
          "description": "Botnet Command and Control \nCobalt Strike\nMisc Attack\nHidden users\nTargets: network, url, music publishing company, artists, owner, associates, advertising, visibility, reputations, digital profile.\nCountry origination: United States",
          "modified": "2023-11-06T03:00:36.709000",
          "created": "2023-10-07T05:14:38.342000",
          "tags": [
            "noname057",
            "song culture",
            "brashears music",
            "culture",
            "tsara lynn",
            "falcon sandbox",
            "brashears song",
            "nights",
            "kedence",
            "service",
            "sandbox",
            "cool",
            "music",
            "secure",
            "httponly",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "united",
            "flag",
            "contacted",
            "emotet",
            "NSIS",
            "trellian",
            "apple",
            "apk",
            "os",
            "ios",
            "android",
            "google",
            "Google search",
            "dns",
            "query",
            "poisoning",
            "hacking",
            "injection",
            "login",
            "logon",
            "phishing",
            "scanning_host",
            "VM",
            "file query",
            "detect",
            "windir",
            "api call",
            "api",
            "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call",
            "\"iexplore.exe\" trying to touch file",
            "attack",
            "target",
            "jeffrey",
            "reimer",
            "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v",
            "suricata",
            "alert",
            "cyber threat",
            "dpt",
            "porn",
            "pixelrz",
            "dead",
            "hifi",
            "track",
            "jeffrey reimer dpt",
            "redirect",
            "pattern match",
            "tbmisch",
            "contentlength",
            "mcfunction",
            "ck id",
            "t1071",
            "mitre att",
            "ck matrix",
            "drops",
            "content reputation",
            "malware",
            "malvertizing",
            "misc attack",
            "mitre",
            "file access",
            "files marked clean",
            "evasive",
            "cisco umbrella",
            "safe site",
            "site",
            "windows nt",
            "file",
            "network related",
            "https webserver",
            "getpost",
            "get search",
            "geckohost",
            "jpeg image",
            "jfif",
            "png image",
            "gif image",
            "binary file",
            "t1105",
            "show technique",
            "click",
            "blacklist",
            "generic malware",
            "DNS Requests",
            "persistence",
            "gmt0600",
            "programfiles",
            "filename",
            "indexed",
            "network",
            "hosts process",
            "openurl c",
            "prefetch2 name",
            "ssl certificate",
            "whois record",
            "threat roundup",
            "execution",
            "march",
            "july",
            "communicating",
            "october",
            "september",
            "referrer",
            "june",
            "april",
            "august",
            "copy",
            "goldfinder",
            "sibot",
            "hacktool",
            "february",
            "skynet",
            "malicious",
            "download",
            "malware",
            "relic",
            "monitoring",
            "installer",
            "project",
            "core",
            "lumma stealer",
            "metro",
            "Anonymizer",
            "virut",
            "scanning ip's",
            "Cobalt Strike",
            "keybase",
            "spam",
            "anonymisation services",
            "malicious host",
            "Botnet Command and Control",
            "Phishing - Mr.Looquer",
            "covid19 scam",
            "social engineering",
            "Jumpseller phishing",
            "phishing: Amazon.com",
            "unauthorized scanning of hosts",
            "phishing huntington bank",
            "malicious url",
            "malicious server",
            "Threats200220200050",
            "ntp open resolver",
            "blackshades",
            "infostealer",
            "rat",
            "infinity",
            "msil",
            "adware",
            "adload",
            "gamarue",
            "pua",
            "keyloggers",
            "browser malware",
            "resolutions",
            "whois whois",
            "historical ssl",
            "subdomains",
            "whois siblings",
            "bradesco",
            "paypal phishing",
            "bad traffic",
            "Yandex",
            "hidden users"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/",
            "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears",
            "Research and Data analysis",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://pixelrz.com/lists/keywords/tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn",
            "DNS Server - Public-dns.info",
            "Autonomous System",
            "AS13414 Twitter Inc",
            "AS32934 Facebook Inc",
            "AS15133 MCI Communications Services Inc d b a Verizon Business",
            "AS13335 - Cloudflare, Inc.  - United States",
            "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn",
            "wTools",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke"
          ],
          "public": 1,
          "adversary": "[Miscellaneous, Unnamed]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Gen:Trojan.Heur",
              "display_name": "Gen:Trojan.Heur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Emotet - S0367",
              "display_name": "Emotet - S0367",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "GoldFinder - S0597",
              "display_name": "GoldFinder - S0597",
              "target": null
            },
            {
              "id": "BlackShades Crypter",
              "display_name": "BlackShades Crypter",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [
            "Media",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 860,
            "FileHash-SHA1": 488,
            "FileHash-SHA256": 1407,
            "domain": 226,
            "hostname": 557,
            "URL": 589
          },
          "indicator_count": 4127,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "938 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/",
        "AS15133 MCI Communications Services Inc d b a Verizon Business",
        "AS32934 Facebook Inc",
        "AS13335 - Cloudflare, Inc.  - United States",
        "wTools",
        "https://amp.hifiporn.cc/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-",
        "Autonomous System",
        "DNS Server - Public-dns.info",
        "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/",
        "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer",
        "AS13414 Twitter Inc",
        "http://pixelrz.com/lists/keywords/tsara-brashears",
        "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer No Expiration http://pixelrz.com/lists/keywords/tsara-brashears-dead",
        "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn",
        "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t  URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t  URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati",
        "Research and Data analysis"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "[Miscellaneous, Unnamed]"
          ],
          "malware_families": [
            "Gen:variant.zusy",
            "Gamehack",
            "Maltiverse",
            "Blackshades crypter",
            "Cyber criminal",
            "Gen:trojan.heur",
            "Cobalt strike",
            "Lumma stealer",
            "Emotet - s0367",
            "Generic.malware",
            "Goldfinder - s0597",
            "Verified",
            "Webtoolbar",
            "Virut",
            "Trojanspy"
          ],
          "industries": [
            "Telecommunications",
            "Media",
            "Technology"
          ],
          "unique_indicators": 30754
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/microsoftonline.cn",
    "whois": "http://whois.domaintools.com/microsoftonline.cn",
    "domain": "microsoftonline.cn",
    "hostname": "login.partner.microsoftonline.cn"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 26,
  "pulses": [
    {
      "id": "6570a8e51a92ae866818d432",
      "name": "Apple link - Critical risk found",
      "description": "",
      "modified": "2023-12-06T17:01:25.538000",
      "created": "2023-12-06T17:01:25.538000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1090,
        "URL": 866,
        "hostname": 581,
        "domain": 101,
        "FileHash-MD5": 72,
        "FileHash-SHA1": 63
      },
      "indicator_count": 2773,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a8e11f1fc3b551c19f8d",
      "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
      "description": "",
      "modified": "2023-12-06T17:01:21.406000",
      "created": "2023-12-06T17:01:21.406000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 210,
        "hostname": 242,
        "domain": 87,
        "URL": 506,
        "FileHash-MD5": 21,
        "FileHash-SHA1": 13
      },
      "indicator_count": 1079,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a8ddf417154b2bfc3446",
      "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
      "description": "",
      "modified": "2023-12-06T17:01:17.482000",
      "created": "2023-12-06T17:01:17.482000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 210,
        "hostname": 242,
        "domain": 87,
        "URL": 506,
        "FileHash-MD5": 21,
        "FileHash-SHA1": 13
      },
      "indicator_count": 1079,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a8d9de9710087f6f91b3",
      "name": "Apple - Malicious activities found in iOS link | verified cyber criminal.    | CVE 2023-????",
      "description": "",
      "modified": "2023-12-06T17:01:13.202000",
      "created": "2023-12-06T17:01:13.202000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1090,
        "hostname": 427,
        "domain": 89,
        "URL": 545,
        "FileHash-MD5": 72,
        "FileHash-SHA1": 63
      },
      "indicator_count": 2286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a8d167202b93ee502ff8",
      "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
      "description": "",
      "modified": "2023-12-06T17:01:05.291000",
      "created": "2023-12-06T17:01:05.291000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 12,
        "URL": 3839,
        "hostname": 1331,
        "FileHash-SHA256": 2976,
        "domain": 757,
        "FileHash-MD5": 250,
        "FileHash-SHA1": 80
      },
      "indicator_count": 9245,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a857cae685fce7f5231e",
      "name": "Phishing - bam-cell.cell.nr-data.net",
      "description": "",
      "modified": "2023-12-06T16:59:03.209000",
      "created": "2023-12-06T16:59:03.209000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 2052,
        "hostname": 1185,
        "domain": 460,
        "URL": 4294,
        "FileHash-MD5": 10,
        "FileHash-SHA1": 11
      },
      "indicator_count": 8013,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a81314a587dca8a7e075",
      "name": "Blackshades  | Remote attacks | Malicious Google Search | DNS Requests",
      "description": "",
      "modified": "2023-12-06T16:57:55.292000",
      "created": "2023-12-06T16:57:55.292000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1407,
        "hostname": 557,
        "domain": 226,
        "FileHash-MD5": 860,
        "FileHash-SHA1": 488,
        "URL": 589
      },
      "indicator_count": 4127,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a80d15fdb40571638038",
      "name": "Blackshades  | Remote attacks | Malicious Google Search | DNS Requests",
      "description": "",
      "modified": "2023-12-06T16:57:49.914000",
      "created": "2023-12-06T16:57:49.914000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1407,
        "hostname": 557,
        "domain": 226,
        "FileHash-MD5": 860,
        "FileHash-SHA1": 488,
        "URL": 589
      },
      "indicator_count": 4127,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656a97db9134b17c1f6d845b",
      "name": "DeepScan:Generic.Ransom.GandCrab5",
      "description": "",
      "modified": "2023-12-02T02:35:07.890000",
      "created": "2023-12-02T02:35:07.890000",
      "tags": [
        "cisco umbrella",
        "site",
        "safe site",
        "detection list",
        "blacklist",
        "million",
        "malicious url",
        "maltiverse",
        "heuristic",
        "redirme",
        "exploit",
        "malware",
        "team",
        "microsoft",
        "urlhttps",
        "blacklist https",
        "noname057",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "hacktool",
        "arkeistealer",
        "mail spammer",
        "united",
        "germany",
        "opencandy",
        "proxy",
        "firehol",
        "alexa top",
        "phishing site",
        "malicious site",
        "malware site",
        "alexa",
        "phishing",
        "iframe",
        "downldr",
        "agent",
        "presenoker",
        "riskware",
        "unsafe",
        "artemis",
        "bank",
        "cve201711882",
        "tag count",
        "cyber threat",
        "httponly",
        "samesitenone",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "pragma",
        "contacted urls",
        "ssl certificate",
        "whois record",
        "xmodeargs",
        "whois whois",
        "xdpid1203",
        "xpubid10839",
        "september",
        "tsara brashears",
        "collection",
        "emotet",
        "malicious",
        "critical",
        "copy",
        "installer",
        "banker",
        "keylogger",
        "heur",
        "filerepmetagen",
        "suspected",
        "adware",
        "acint",
        "nircmd",
        "swrort",
        "systweak",
        "behav",
        "crack",
        "tiggre",
        "genkryptik",
        "filetour",
        "cleaner",
        "conduit",
        "wacatac",
        "trojanspy",
        "webtoolbar"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6541df216e018a0bce63e2a3",
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2559,
        "CVE": 6,
        "FileHash-MD5": 582,
        "FileHash-SHA1": 353,
        "FileHash-SHA256": 3232,
        "hostname": 826,
        "domain": 206,
        "URI": 1
      },
      "indicator_count": 7765,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "912 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6541df216e018a0bce63e2a3",
      "name": "DeepScan:Generic.Ransom.GandCrab5",
      "description": "Malicious redirect. OWA? Dreaded Canary cookie? I don't know yet. Link affects individuals, corporations and edu's. \n\n{*https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic\n*Redirects to: https://login.microsoftonline.com/jsdisabled}\n(AUTO POPULATED: A full list of findings from the Maltiverse Research Team on Malware and Exploit, as compiled by the National Security Agency (NSA), has been published on the website of Microsoft's website.)",
      "modified": "2023-12-01T04:05:20.963000",
      "created": "2023-11-01T05:16:17.835000",
      "tags": [
        "cisco umbrella",
        "site",
        "safe site",
        "detection list",
        "blacklist",
        "million",
        "malicious url",
        "maltiverse",
        "heuristic",
        "redirme",
        "exploit",
        "malware",
        "team",
        "microsoft",
        "urlhttps",
        "blacklist https",
        "noname057",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "hacktool",
        "arkeistealer",
        "mail spammer",
        "united",
        "germany",
        "opencandy",
        "proxy",
        "firehol",
        "alexa top",
        "phishing site",
        "malicious site",
        "malware site",
        "alexa",
        "phishing",
        "iframe",
        "downldr",
        "agent",
        "presenoker",
        "riskware",
        "unsafe",
        "artemis",
        "bank",
        "cve201711882",
        "tag count",
        "cyber threat",
        "httponly",
        "samesitenone",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "pragma",
        "contacted urls",
        "ssl certificate",
        "whois record",
        "xmodeargs",
        "whois whois",
        "xdpid1203",
        "xpubid10839",
        "september",
        "tsara brashears",
        "collection",
        "emotet",
        "malicious",
        "critical",
        "copy",
        "installer",
        "banker",
        "keylogger",
        "heur",
        "filerepmetagen",
        "suspected",
        "adware",
        "acint",
        "nircmd",
        "swrort",
        "systweak",
        "behav",
        "crack",
        "tiggre",
        "genkryptik",
        "filetour",
        "cleaner",
        "conduit",
        "wacatac",
        "trojanspy",
        "webtoolbar"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2559,
        "CVE": 6,
        "FileHash-MD5": 582,
        "FileHash-SHA1": 353,
        "FileHash-SHA256": 3232,
        "hostname": 826,
        "domain": 206,
        "URI": 1
      },
      "indicator_count": 7765,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "912 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://login.partner.microsoftonline.cn/.%",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://login.partner.microsoftonline.cn/.%",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780283946.6428726
}