{
  "type": "URL",
  "indicator": "https://m.pornmd.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://m.pornmd.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3958973214,
      "indicator": "https://m.pornmd.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "688ef0516013ca78448bf4e5",
          "name": "Foundry \u2022 Reflected Networks Pornhub Malvertising Subsidiary",
          "description": "Foundry ?  Pornhub\nsanfoundry.com\ncompliance.fifoundry.net- Pornhub subsidiary. Targets networks, devices, routers, used for promoting pornography and her music. Producer revealed her hooks were used for Justin Bieber &  Tori Kelly songs that. A producer stated her songs had been grifted. Both Tsara Brashears & a studio were in Pegasus & attacked by \u2018Lazarus\u2019 Group. She was told in detail how her songs can be used by music insiders if they choose.  Target trolled by mocking hackers re: the JB and Kelly song.. Trojan:Win32/DisableUAC.A!bit\n, MSIL:Suspicious:ScreenCapture.S01\nIDS Detections\nLokiBot Checkin\nLokiBot User-Agent (Charon/Inferno)\nLokiBot Application/Credential Data Exfiltration Detected M1\nLokiBot Request for C2 Commands Detected M1\nLokiBot Application/Credential Data Exfiltration Detected M2\nLokiBot Request for C2 Commands Detected M2\nTrojan Generic - POST To gate.php with no referer\nSSL excessive fatal alerts (possible POODLE attack against server)\nI will revisit this. Gloryhole Foundation?",
          "modified": "2025-09-02T04:01:31.218000",
          "created": "2025-08-03T05:14:57.402000",
          "tags": [
            "united",
            "moved",
            "entries",
            "passive dns",
            "detected m1",
            "next associated",
            "mtb apr",
            "mtb aug",
            "server",
            "gmt content",
            "trojandropper",
            "trojan",
            "body",
            "lokibot request",
            "c2 commands",
            "detected m2",
            "otx telemetry",
            "historical otx",
            "twitter running",
            "open ports",
            "cves",
            "time",
            "dynamicloader",
            "port",
            "search",
            "show",
            "destination",
            "alerts",
            "copy",
            "dynamic",
            "medium",
            "write",
            "creation date",
            "hostmaster",
            "urls",
            "domain",
            "showing",
            "hostname add",
            "pulse pulses",
            "date",
            "flag",
            "falcon sandbox",
            "name server",
            "markmonitor",
            "analysis",
            "mitre att",
            "anonymous",
            "upgrade",
            "hybrid",
            "contact",
            "usa windows",
            "december",
            "input threat",
            "level analysis",
            "summary",
            "february",
            "hwp support",
            "january",
            "october",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "calls",
            "command",
            "javascript",
            "object model",
            "model",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "temp",
            "getprocaddress",
            "script",
            "license",
            "runtime process",
            "copy md5",
            "facebook",
            "roboto",
            "error",
            "win64",
            "path",
            "blink",
            "meta",
            "factory",
            "general",
            "comspec",
            "click",
            "strings",
            "damage",
            "mini",
            "stop",
            "core",
            "expl",
            "win32",
            "gmt server",
            "ecacc saa83dd",
            "ipv4 add",
            "twitter",
            "cobalt strike",
            "mozilla"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 263,
            "FileHash-SHA1": 256,
            "FileHash-SHA256": 837,
            "hostname": 4415,
            "URL": 1918,
            "domain": 1884,
            "email": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9577,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "229 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6888a85aa32aab22f638d0e6",
          "name": "Autodesk issue in CrowdStrike prior to outage | [by scoreblue]",
          "description": "",
          "modified": "2025-07-29T10:54:18.501000",
          "created": "2025-07-29T10:54:18.501000",
          "tags": [
            "healthy check",
            "ssl bypass",
            "domain tracker",
            "privacy badger",
            "startpage",
            "w11 pc",
            "pass",
            "iocs",
            "all scoreblue",
            "pdf report",
            "pcap",
            "stix",
            "avast avg",
            "no expiration",
            "status",
            "name servers",
            "moved",
            "h1 center",
            "next",
            "sec ch",
            "ch ua",
            "ua platform",
            "emails",
            "certificate",
            "passive dns",
            "urls",
            "encrypt",
            "body",
            "pe32 executable",
            "ms windows",
            "intel",
            "windows control",
            "panel item",
            "dos borland",
            "executable",
            "algorithm",
            "thumbprint",
            "serial number",
            "signing ca",
            "symantec time",
            "stamping",
            "g2 name",
            "g2 issuer",
            "class",
            "code",
            "kb pe",
            "csc corporate",
            "porkbun llc",
            "gandi sas",
            "request",
            "path",
            "get https",
            "get http",
            "response",
            "cachecontrol",
            "pragma",
            "connection",
            "gmt connection",
            "accept",
            "slug",
            "as29789",
            "united",
            "unknown",
            "ransom",
            "heur",
            "server",
            "registrar abuse",
            "san rafael",
            "autodesk",
            "contact phone",
            "registrar url",
            "process32nextw",
            "create c",
            "read c",
            "writeconsolew",
            "delete",
            "write",
            "show",
            "malware",
            "write c",
            "regsetvalueexa",
            "delete c",
            "search",
            "regdword",
            "whitelisted",
            "panda banker",
            "ursnif",
            "win32",
            "persistence",
            "execution",
            "banker",
            "local",
            "domain",
            "servers",
            "pulse pulses",
            "files",
            "ip address",
            "creation date",
            "united kingdom",
            "as9009 m247",
            "ipv4",
            "pulse submit",
            "url analysis",
            "twitter",
            "as16552 tiggee",
            "as397241",
            "as397240",
            "entries",
            "cname",
            "nxdomain",
            "a nxdomain",
            "worm",
            "file samples",
            "files matching",
            "alf features",
            "denver co",
            "wewatta",
            "scan endpoints",
            "related pulses",
            "date hash",
            "showing",
            "as62597 nsone",
            "date",
            "trojanspy",
            "cookie",
            "hostmaster",
            "expiration date",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tls handshake",
            "et info",
            "getdc0x2a",
            "failure",
            "post http",
            "copy",
            "crash",
            "ascii text",
            "ascii",
            "jpeg image",
            "artemis",
            "trojan",
            "virustotal",
            "mike",
            "vipre",
            "panda",
            "win32mediadrug",
            "win324shared",
            "win32spigot",
            "hstr",
            "lowfi",
            "yara detections",
            "contacted",
            "report spam",
            "mozilla",
            "trojanclicker",
            "url http",
            "url https",
            "role title",
            "added active",
            "type indicator",
            "source domain",
            "akamai rank",
            "hostname",
            "ver2",
            "msclkidn",
            "vids0",
            "global outage",
            "cobalt strike",
            "fancy bear",
            "communications",
            "android device",
            "cnc beacon",
            "suspicious ua",
            "youtube",
            "sakula rat",
            "mivast",
            "sakula",
            "windows",
            "samuel tulach",
            "light dark",
            "samuel",
            "tulach",
            "hyperv",
            "detecting",
            "writing gui",
            "bootkits",
            "world",
            "information",
            "discovery",
            "t1027",
            "t1057",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1129",
            "capture",
            "service",
            "t1119"
          ],
          "references": [
            "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
            "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
            "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
            "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
            "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
            "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
            "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
            "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
            "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
            "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
            "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
            "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
            "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
            "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
            "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
            "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
            "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
            "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
            "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
            "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
            "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
            "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
            "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
            "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
            "Above links in search results direct out with and arrow pointing out.",
            "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
            "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
            "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
            "boot.net.anydesk.com removed from my Pulse below",
            "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Win32:Mystic",
              "display_name": "Win32:Mystic",
              "target": null
            },
            {
              "id": "Win.Trojan.Xblocker-236",
              "display_name": "Win.Trojan.Xblocker-236",
              "target": null
            },
            {
              "id": "Ransom:Win32/Genasom",
              "display_name": "Ransom:Win32/Genasom",
              "target": "/malware/Ransom:Win32/Genasom"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Usteal",
              "display_name": "TrojanSpy:Win32/Usteal",
              "target": "/malware/TrojanSpy:Win32/Usteal"
            },
            {
              "id": "Win.Trojan.PoetRat-7669676-0",
              "display_name": "Win.Trojan.PoetRat-7669676-0",
              "target": null
            },
            {
              "id": "Mivast",
              "display_name": "Mivast",
              "target": null
            },
            {
              "id": "Sakula",
              "display_name": "Sakula",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1021",
              "name": "Remote Services",
              "display_name": "T1021 - Remote Services"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "66d89c45ddc0c7db084b75b7",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1417,
            "FileHash-SHA1": 1165,
            "FileHash-SHA256": 6536,
            "URL": 6112,
            "domain": 1340,
            "hostname": 2654,
            "email": 15,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 19248,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "264 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66f351ce26a103377d8eb5fa",
          "name": "Sex Tokens | Injection \u00bb Porn dumping - Cyber Folks .PL | Spectrum",
          "description": "Porn dumping into targeted devices after great effort. \nHall Render has always been a Malware Hosting website.\nDrive by compromise,    \nPorn Storm compilation.\n\nhttps://api.dotz.com.br/accounts/api/default/externallogin/login",
          "modified": "2024-10-24T22:01:13.406000",
          "created": "2024-09-24T23:57:02.111000",
          "tags": [
            "url https",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "porn type",
            "showing",
            "entries",
            "tsara type",
            "pulses url",
            "adware backdoor",
            "email document",
            "exploit domain",
            "owner exploit",
            "kit exploit",
            "source file",
            "hacking tools",
            "hunting macro",
            "malware hosting",
            "memory scanning",
            "wild fantasy",
            "world",
            "download",
            "xxx video",
            "xxx sex",
            "desi",
            "tamil",
            "videos xxx",
            "hd posts",
            "photos pics",
            "https",
            "indicator role",
            "title added",
            "active related",
            "unknown",
            "united",
            "for privacy",
            "nxdomain",
            "meta",
            "internet gmbh",
            "creation date",
            "date",
            "audio",
            "clear hindi",
            "bhabi sex",
            "bedroom indian",
            "fakaid",
            "ww3008",
            "fingering her",
            "young boy",
            "sexy",
            "next",
            "witch",
            "filehashmd5",
            "ipv4",
            "months ago",
            "information",
            "scan endpoints",
            "all scoreblue",
            "report spam",
            "created",
            "modified",
            "zbot",
            "keyword",
            "latina",
            "teen sex",
            "jeffrey reimer",
            "reimer dpt",
            "jeff reimer sex",
            "reimer type",
            "hostname",
            "domain",
            "copyright",
            "remote",
            "t1003",
            "os credential",
            "dumping",
            "t1012",
            "t1036",
            "t1071",
            "protocol",
            "t1082",
            "as8075",
            "aaaa",
            "as30148 sucuri",
            "certificate",
            "record value",
            "body",
            "status",
            "passive dns",
            "urls",
            "hallrender",
            "brian sabey",
            "sabey xxx",
            "drive by compromise",
            "cobalt strike",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "china flag",
            "china domain",
            "files related",
            "pulses none",
            "files domain",
            "analyzer paste",
            "iocs",
            "hostnames",
            "urls https",
            "china unknown",
            "as4837 china",
            "redacted for",
            "a domains",
            "cname",
            "jeffrey reimer pt",
            "sucuri website",
            "span td",
            "time",
            "firewall",
            "win64",
            "back",
            "xtra",
            "name servers",
            "files",
            "tls web",
            "log id",
            "gmtn",
            "false",
            "ocsp",
            "ca issuers",
            "phucket news",
            "hacking",
            "registrar abuse",
            "gateway protocol abuse",
            "swipper relationship"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1428",
              "name": "Exploit Enterprise Resources",
              "display_name": "T1428 - Exploit Enterprise Resources"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1599,
            "hostname": 2988,
            "URL": 8561,
            "FileHash-SHA256": 1207,
            "email": 41,
            "FileHash-MD5": 126,
            "FileHash-SHA1": 36,
            "CVE": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 14561,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "541 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d89c45ddc0c7db084b75b7",
          "name": "Autodesk weakens CS | Unauthorized AlienVault API | Stolen pulsed",
          "description": "Critical issues within AlienVault , VT & my devices. Plugins auto installed after I opened  message from AV user. Sudden redirects to 0/ http/s.   Heavy modifications, removal of IoC's  on AV & VT  & Virus Total. Autodesk.com was under CrowdStrike  until last night. Links where vulnerabilities were originating from completely disappeared from graph I kindly kept private. Continuous mods for  months to Crowdstrike and other  pulses. [https://otx.alienvault.com/api appears in search] A page opens with Tag: \"esta caliente\" | All linked pulses Gone. Only person who frequently contacted me appears where they didn't before & These dishonest billion $ companies cover up though they are at fault for allowing ALL threat actor to be protected with  non adversarial businesses.  Besides other compromises, surprisingly Brashears porn found in Crowdstrike/Autodesk  others. Disappointing.",
          "modified": "2024-10-04T17:02:07.067000",
          "created": "2024-09-04T17:43:33.123000",
          "tags": [
            "healthy check",
            "ssl bypass",
            "domain tracker",
            "privacy badger",
            "startpage",
            "w11 pc",
            "pass",
            "iocs",
            "all scoreblue",
            "pdf report",
            "pcap",
            "stix",
            "avast avg",
            "no expiration",
            "status",
            "name servers",
            "moved",
            "h1 center",
            "next",
            "sec ch",
            "ch ua",
            "ua platform",
            "emails",
            "certificate",
            "passive dns",
            "urls",
            "encrypt",
            "body",
            "pe32 executable",
            "ms windows",
            "intel",
            "windows control",
            "panel item",
            "dos borland",
            "executable",
            "algorithm",
            "thumbprint",
            "serial number",
            "signing ca",
            "symantec time",
            "stamping",
            "g2 name",
            "g2 issuer",
            "class",
            "code",
            "kb pe",
            "csc corporate",
            "porkbun llc",
            "gandi sas",
            "request",
            "path",
            "get https",
            "get http",
            "response",
            "cachecontrol",
            "pragma",
            "connection",
            "gmt connection",
            "accept",
            "slug",
            "as29789",
            "united",
            "unknown",
            "ransom",
            "heur",
            "server",
            "registrar abuse",
            "san rafael",
            "autodesk",
            "contact phone",
            "registrar url",
            "process32nextw",
            "create c",
            "read c",
            "writeconsolew",
            "delete",
            "write",
            "show",
            "malware",
            "write c",
            "regsetvalueexa",
            "delete c",
            "search",
            "regdword",
            "whitelisted",
            "panda banker",
            "ursnif",
            "win32",
            "persistence",
            "execution",
            "banker",
            "local",
            "domain",
            "servers",
            "pulse pulses",
            "files",
            "ip address",
            "creation date",
            "united kingdom",
            "as9009 m247",
            "ipv4",
            "pulse submit",
            "url analysis",
            "twitter",
            "as16552 tiggee",
            "as397241",
            "as397240",
            "entries",
            "cname",
            "nxdomain",
            "a nxdomain",
            "worm",
            "file samples",
            "files matching",
            "alf features",
            "denver co",
            "wewatta",
            "scan endpoints",
            "related pulses",
            "date hash",
            "showing",
            "as62597 nsone",
            "date",
            "trojanspy",
            "cookie",
            "hostmaster",
            "expiration date",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tls handshake",
            "et info",
            "getdc0x2a",
            "failure",
            "post http",
            "copy",
            "crash",
            "ascii text",
            "ascii",
            "jpeg image",
            "artemis",
            "trojan",
            "virustotal",
            "mike",
            "vipre",
            "panda",
            "win32mediadrug",
            "win324shared",
            "win32spigot",
            "hstr",
            "lowfi",
            "yara detections",
            "contacted",
            "report spam",
            "mozilla",
            "trojanclicker",
            "url http",
            "url https",
            "role title",
            "added active",
            "type indicator",
            "source domain",
            "akamai rank",
            "hostname",
            "ver2",
            "msclkidn",
            "vids0",
            "global outage",
            "cobalt strike",
            "fancy bear",
            "communications",
            "android device",
            "cnc beacon",
            "suspicious ua",
            "youtube",
            "sakula rat",
            "mivast",
            "sakula",
            "windows",
            "samuel tulach",
            "light dark",
            "samuel",
            "tulach",
            "hyperv",
            "detecting",
            "writing gui",
            "bootkits",
            "world",
            "information",
            "discovery",
            "t1027",
            "t1057",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1129",
            "capture",
            "service",
            "t1119"
          ],
          "references": [
            "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
            "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
            "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
            "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
            "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
            "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
            "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
            "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
            "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
            "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
            "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
            "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
            "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
            "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
            "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
            "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
            "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
            "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
            "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
            "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
            "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
            "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
            "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
            "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
            "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
            "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
            "Above links in search results direct out with and arrow pointing out.",
            "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
            "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
            "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
            "boot.net.anydesk.com removed from my Pulse below",
            "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Win32:Mystic",
              "display_name": "Win32:Mystic",
              "target": null
            },
            {
              "id": "Win.Trojan.Xblocker-236",
              "display_name": "Win.Trojan.Xblocker-236",
              "target": null
            },
            {
              "id": "Ransom:Win32/Genasom",
              "display_name": "Ransom:Win32/Genasom",
              "target": "/malware/Ransom:Win32/Genasom"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Usteal",
              "display_name": "TrojanSpy:Win32/Usteal",
              "target": "/malware/TrojanSpy:Win32/Usteal"
            },
            {
              "id": "Win.Trojan.PoetRat-7669676-0",
              "display_name": "Win.Trojan.PoetRat-7669676-0",
              "target": null
            },
            {
              "id": "Mivast",
              "display_name": "Mivast",
              "target": null
            },
            {
              "id": "Sakula",
              "display_name": "Sakula",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1021",
              "name": "Remote Services",
              "display_name": "T1021 - Remote Services"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 38,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1417,
            "FileHash-SHA1": 1165,
            "FileHash-SHA256": 6536,
            "URL": 6112,
            "domain": 1340,
            "hostname": 2654,
            "email": 15,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 19248,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "561 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Above links in search results direct out with and arrow pointing out.",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "boot.net.anydesk.com removed from my Pulse below",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Mivast",
            "Sakula",
            "#lowfienabledtcontinueafterunpacking",
            "Trojanspy",
            "Win.trojan.xblocker-236",
            "Worm:win32/autorun",
            "Win.trojan.poetrat-7669676-0",
            "Ransom:win32/genasom",
            "Win32:mystic",
            "Trojanspy:win32/usteal",
            "Alf:jasyp:backdoor:win32/cycbot"
          ],
          "industries": [],
          "unique_indicators": 42343
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/pornmd.com",
    "whois": "http://whois.domaintools.com/pornmd.com",
    "domain": "pornmd.com",
    "hostname": "m.pornmd.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "688ef0516013ca78448bf4e5",
      "name": "Foundry \u2022 Reflected Networks Pornhub Malvertising Subsidiary",
      "description": "Foundry ?  Pornhub\nsanfoundry.com\ncompliance.fifoundry.net- Pornhub subsidiary. Targets networks, devices, routers, used for promoting pornography and her music. Producer revealed her hooks were used for Justin Bieber &  Tori Kelly songs that. A producer stated her songs had been grifted. Both Tsara Brashears & a studio were in Pegasus & attacked by \u2018Lazarus\u2019 Group. She was told in detail how her songs can be used by music insiders if they choose.  Target trolled by mocking hackers re: the JB and Kelly song.. Trojan:Win32/DisableUAC.A!bit\n, MSIL:Suspicious:ScreenCapture.S01\nIDS Detections\nLokiBot Checkin\nLokiBot User-Agent (Charon/Inferno)\nLokiBot Application/Credential Data Exfiltration Detected M1\nLokiBot Request for C2 Commands Detected M1\nLokiBot Application/Credential Data Exfiltration Detected M2\nLokiBot Request for C2 Commands Detected M2\nTrojan Generic - POST To gate.php with no referer\nSSL excessive fatal alerts (possible POODLE attack against server)\nI will revisit this. Gloryhole Foundation?",
      "modified": "2025-09-02T04:01:31.218000",
      "created": "2025-08-03T05:14:57.402000",
      "tags": [
        "united",
        "moved",
        "entries",
        "passive dns",
        "detected m1",
        "next associated",
        "mtb apr",
        "mtb aug",
        "server",
        "gmt content",
        "trojandropper",
        "trojan",
        "body",
        "lokibot request",
        "c2 commands",
        "detected m2",
        "otx telemetry",
        "historical otx",
        "twitter running",
        "open ports",
        "cves",
        "time",
        "dynamicloader",
        "port",
        "search",
        "show",
        "destination",
        "alerts",
        "copy",
        "dynamic",
        "medium",
        "write",
        "creation date",
        "hostmaster",
        "urls",
        "domain",
        "showing",
        "hostname add",
        "pulse pulses",
        "date",
        "flag",
        "falcon sandbox",
        "name server",
        "markmonitor",
        "analysis",
        "mitre att",
        "anonymous",
        "upgrade",
        "hybrid",
        "contact",
        "usa windows",
        "december",
        "input threat",
        "level analysis",
        "summary",
        "february",
        "hwp support",
        "january",
        "october",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "calls",
        "command",
        "javascript",
        "object model",
        "model",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "temp",
        "getprocaddress",
        "script",
        "license",
        "runtime process",
        "copy md5",
        "facebook",
        "roboto",
        "error",
        "win64",
        "path",
        "blink",
        "meta",
        "factory",
        "general",
        "comspec",
        "click",
        "strings",
        "damage",
        "mini",
        "stop",
        "core",
        "expl",
        "win32",
        "gmt server",
        "ecacc saa83dd",
        "ipv4 add",
        "twitter",
        "cobalt strike",
        "mozilla"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 263,
        "FileHash-SHA1": 256,
        "FileHash-SHA256": 837,
        "hostname": 4415,
        "URL": 1918,
        "domain": 1884,
        "email": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 9577,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "229 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6888a85aa32aab22f638d0e6",
      "name": "Autodesk issue in CrowdStrike prior to outage | [by scoreblue]",
      "description": "",
      "modified": "2025-07-29T10:54:18.501000",
      "created": "2025-07-29T10:54:18.501000",
      "tags": [
        "healthy check",
        "ssl bypass",
        "domain tracker",
        "privacy badger",
        "startpage",
        "w11 pc",
        "pass",
        "iocs",
        "all scoreblue",
        "pdf report",
        "pcap",
        "stix",
        "avast avg",
        "no expiration",
        "status",
        "name servers",
        "moved",
        "h1 center",
        "next",
        "sec ch",
        "ch ua",
        "ua platform",
        "emails",
        "certificate",
        "passive dns",
        "urls",
        "encrypt",
        "body",
        "pe32 executable",
        "ms windows",
        "intel",
        "windows control",
        "panel item",
        "dos borland",
        "executable",
        "algorithm",
        "thumbprint",
        "serial number",
        "signing ca",
        "symantec time",
        "stamping",
        "g2 name",
        "g2 issuer",
        "class",
        "code",
        "kb pe",
        "csc corporate",
        "porkbun llc",
        "gandi sas",
        "request",
        "path",
        "get https",
        "get http",
        "response",
        "cachecontrol",
        "pragma",
        "connection",
        "gmt connection",
        "accept",
        "slug",
        "as29789",
        "united",
        "unknown",
        "ransom",
        "heur",
        "server",
        "registrar abuse",
        "san rafael",
        "autodesk",
        "contact phone",
        "registrar url",
        "process32nextw",
        "create c",
        "read c",
        "writeconsolew",
        "delete",
        "write",
        "show",
        "malware",
        "write c",
        "regsetvalueexa",
        "delete c",
        "search",
        "regdword",
        "whitelisted",
        "panda banker",
        "ursnif",
        "win32",
        "persistence",
        "execution",
        "banker",
        "local",
        "domain",
        "servers",
        "pulse pulses",
        "files",
        "ip address",
        "creation date",
        "united kingdom",
        "as9009 m247",
        "ipv4",
        "pulse submit",
        "url analysis",
        "twitter",
        "as16552 tiggee",
        "as397241",
        "as397240",
        "entries",
        "cname",
        "nxdomain",
        "a nxdomain",
        "worm",
        "file samples",
        "files matching",
        "alf features",
        "denver co",
        "wewatta",
        "scan endpoints",
        "related pulses",
        "date hash",
        "showing",
        "as62597 nsone",
        "date",
        "trojanspy",
        "cookie",
        "hostmaster",
        "expiration date",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tls handshake",
        "et info",
        "getdc0x2a",
        "failure",
        "post http",
        "copy",
        "crash",
        "ascii text",
        "ascii",
        "jpeg image",
        "artemis",
        "trojan",
        "virustotal",
        "mike",
        "vipre",
        "panda",
        "win32mediadrug",
        "win324shared",
        "win32spigot",
        "hstr",
        "lowfi",
        "yara detections",
        "contacted",
        "report spam",
        "mozilla",
        "trojanclicker",
        "url http",
        "url https",
        "role title",
        "added active",
        "type indicator",
        "source domain",
        "akamai rank",
        "hostname",
        "ver2",
        "msclkidn",
        "vids0",
        "global outage",
        "cobalt strike",
        "fancy bear",
        "communications",
        "android device",
        "cnc beacon",
        "suspicious ua",
        "youtube",
        "sakula rat",
        "mivast",
        "sakula",
        "windows",
        "samuel tulach",
        "light dark",
        "samuel",
        "tulach",
        "hyperv",
        "detecting",
        "writing gui",
        "bootkits",
        "world",
        "information",
        "discovery",
        "t1027",
        "t1057",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1129",
        "capture",
        "service",
        "t1119"
      ],
      "references": [
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Above links in search results direct out with and arrow pointing out.",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "boot.net.anydesk.com removed from my Pulse below",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Win32:Mystic",
          "display_name": "Win32:Mystic",
          "target": null
        },
        {
          "id": "Win.Trojan.Xblocker-236",
          "display_name": "Win.Trojan.Xblocker-236",
          "target": null
        },
        {
          "id": "Ransom:Win32/Genasom",
          "display_name": "Ransom:Win32/Genasom",
          "target": "/malware/Ransom:Win32/Genasom"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Usteal",
          "display_name": "TrojanSpy:Win32/Usteal",
          "target": "/malware/TrojanSpy:Win32/Usteal"
        },
        {
          "id": "Win.Trojan.PoetRat-7669676-0",
          "display_name": "Win.Trojan.PoetRat-7669676-0",
          "target": null
        },
        {
          "id": "Mivast",
          "display_name": "Mivast",
          "target": null
        },
        {
          "id": "Sakula",
          "display_name": "Sakula",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "display_name": "T1021 - Remote Services"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "66d89c45ddc0c7db084b75b7",
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1417,
        "FileHash-SHA1": 1165,
        "FileHash-SHA256": 6536,
        "URL": 6112,
        "domain": 1340,
        "hostname": 2654,
        "email": 15,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 19248,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "264 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66f351ce26a103377d8eb5fa",
      "name": "Sex Tokens | Injection \u00bb Porn dumping - Cyber Folks .PL | Spectrum",
      "description": "Porn dumping into targeted devices after great effort. \nHall Render has always been a Malware Hosting website.\nDrive by compromise,    \nPorn Storm compilation.\n\nhttps://api.dotz.com.br/accounts/api/default/externallogin/login",
      "modified": "2024-10-24T22:01:13.406000",
      "created": "2024-09-24T23:57:02.111000",
      "tags": [
        "url https",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "porn type",
        "showing",
        "entries",
        "tsara type",
        "pulses url",
        "adware backdoor",
        "email document",
        "exploit domain",
        "owner exploit",
        "kit exploit",
        "source file",
        "hacking tools",
        "hunting macro",
        "malware hosting",
        "memory scanning",
        "wild fantasy",
        "world",
        "download",
        "xxx video",
        "xxx sex",
        "desi",
        "tamil",
        "videos xxx",
        "hd posts",
        "photos pics",
        "https",
        "indicator role",
        "title added",
        "active related",
        "unknown",
        "united",
        "for privacy",
        "nxdomain",
        "meta",
        "internet gmbh",
        "creation date",
        "date",
        "audio",
        "clear hindi",
        "bhabi sex",
        "bedroom indian",
        "fakaid",
        "ww3008",
        "fingering her",
        "young boy",
        "sexy",
        "next",
        "witch",
        "filehashmd5",
        "ipv4",
        "months ago",
        "information",
        "scan endpoints",
        "all scoreblue",
        "report spam",
        "created",
        "modified",
        "zbot",
        "keyword",
        "latina",
        "teen sex",
        "jeffrey reimer",
        "reimer dpt",
        "jeff reimer sex",
        "reimer type",
        "hostname",
        "domain",
        "copyright",
        "remote",
        "t1003",
        "os credential",
        "dumping",
        "t1012",
        "t1036",
        "t1071",
        "protocol",
        "t1082",
        "as8075",
        "aaaa",
        "as30148 sucuri",
        "certificate",
        "record value",
        "body",
        "status",
        "passive dns",
        "urls",
        "hallrender",
        "brian sabey",
        "sabey xxx",
        "drive by compromise",
        "cobalt strike",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "china flag",
        "china domain",
        "files related",
        "pulses none",
        "files domain",
        "analyzer paste",
        "iocs",
        "hostnames",
        "urls https",
        "china unknown",
        "as4837 china",
        "redacted for",
        "a domains",
        "cname",
        "jeffrey reimer pt",
        "sucuri website",
        "span td",
        "time",
        "firewall",
        "win64",
        "back",
        "xtra",
        "name servers",
        "files",
        "tls web",
        "log id",
        "gmtn",
        "false",
        "ocsp",
        "ca issuers",
        "phucket news",
        "hacking",
        "registrar abuse",
        "gateway protocol abuse",
        "swipper relationship"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1428",
          "name": "Exploit Enterprise Resources",
          "display_name": "T1428 - Exploit Enterprise Resources"
        },
        {
          "id": "T1485",
          "name": "Data Destruction",
          "display_name": "T1485 - Data Destruction"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1599,
        "hostname": 2988,
        "URL": 8561,
        "FileHash-SHA256": 1207,
        "email": 41,
        "FileHash-MD5": 126,
        "FileHash-SHA1": 36,
        "CVE": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 14561,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "541 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d89c45ddc0c7db084b75b7",
      "name": "Autodesk weakens CS | Unauthorized AlienVault API | Stolen pulsed",
      "description": "Critical issues within AlienVault , VT & my devices. Plugins auto installed after I opened  message from AV user. Sudden redirects to 0/ http/s.   Heavy modifications, removal of IoC's  on AV & VT  & Virus Total. Autodesk.com was under CrowdStrike  until last night. Links where vulnerabilities were originating from completely disappeared from graph I kindly kept private. Continuous mods for  months to Crowdstrike and other  pulses. [https://otx.alienvault.com/api appears in search] A page opens with Tag: \"esta caliente\" | All linked pulses Gone. Only person who frequently contacted me appears where they didn't before & These dishonest billion $ companies cover up though they are at fault for allowing ALL threat actor to be protected with  non adversarial businesses.  Besides other compromises, surprisingly Brashears porn found in Crowdstrike/Autodesk  others. Disappointing.",
      "modified": "2024-10-04T17:02:07.067000",
      "created": "2024-09-04T17:43:33.123000",
      "tags": [
        "healthy check",
        "ssl bypass",
        "domain tracker",
        "privacy badger",
        "startpage",
        "w11 pc",
        "pass",
        "iocs",
        "all scoreblue",
        "pdf report",
        "pcap",
        "stix",
        "avast avg",
        "no expiration",
        "status",
        "name servers",
        "moved",
        "h1 center",
        "next",
        "sec ch",
        "ch ua",
        "ua platform",
        "emails",
        "certificate",
        "passive dns",
        "urls",
        "encrypt",
        "body",
        "pe32 executable",
        "ms windows",
        "intel",
        "windows control",
        "panel item",
        "dos borland",
        "executable",
        "algorithm",
        "thumbprint",
        "serial number",
        "signing ca",
        "symantec time",
        "stamping",
        "g2 name",
        "g2 issuer",
        "class",
        "code",
        "kb pe",
        "csc corporate",
        "porkbun llc",
        "gandi sas",
        "request",
        "path",
        "get https",
        "get http",
        "response",
        "cachecontrol",
        "pragma",
        "connection",
        "gmt connection",
        "accept",
        "slug",
        "as29789",
        "united",
        "unknown",
        "ransom",
        "heur",
        "server",
        "registrar abuse",
        "san rafael",
        "autodesk",
        "contact phone",
        "registrar url",
        "process32nextw",
        "create c",
        "read c",
        "writeconsolew",
        "delete",
        "write",
        "show",
        "malware",
        "write c",
        "regsetvalueexa",
        "delete c",
        "search",
        "regdword",
        "whitelisted",
        "panda banker",
        "ursnif",
        "win32",
        "persistence",
        "execution",
        "banker",
        "local",
        "domain",
        "servers",
        "pulse pulses",
        "files",
        "ip address",
        "creation date",
        "united kingdom",
        "as9009 m247",
        "ipv4",
        "pulse submit",
        "url analysis",
        "twitter",
        "as16552 tiggee",
        "as397241",
        "as397240",
        "entries",
        "cname",
        "nxdomain",
        "a nxdomain",
        "worm",
        "file samples",
        "files matching",
        "alf features",
        "denver co",
        "wewatta",
        "scan endpoints",
        "related pulses",
        "date hash",
        "showing",
        "as62597 nsone",
        "date",
        "trojanspy",
        "cookie",
        "hostmaster",
        "expiration date",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tls handshake",
        "et info",
        "getdc0x2a",
        "failure",
        "post http",
        "copy",
        "crash",
        "ascii text",
        "ascii",
        "jpeg image",
        "artemis",
        "trojan",
        "virustotal",
        "mike",
        "vipre",
        "panda",
        "win32mediadrug",
        "win324shared",
        "win32spigot",
        "hstr",
        "lowfi",
        "yara detections",
        "contacted",
        "report spam",
        "mozilla",
        "trojanclicker",
        "url http",
        "url https",
        "role title",
        "added active",
        "type indicator",
        "source domain",
        "akamai rank",
        "hostname",
        "ver2",
        "msclkidn",
        "vids0",
        "global outage",
        "cobalt strike",
        "fancy bear",
        "communications",
        "android device",
        "cnc beacon",
        "suspicious ua",
        "youtube",
        "sakula rat",
        "mivast",
        "sakula",
        "windows",
        "samuel tulach",
        "light dark",
        "samuel",
        "tulach",
        "hyperv",
        "detecting",
        "writing gui",
        "bootkits",
        "world",
        "information",
        "discovery",
        "t1027",
        "t1057",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1129",
        "capture",
        "service",
        "t1119"
      ],
      "references": [
        "autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled.",
        "66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com  | brazzersnetwork.com",
        "keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |",
        "Win32:Mystic ,  Win.Trojan.Xblocker-236 \u00bbFileHash-SHA256  8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21",
        "IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection",
        "Win32:BankerX-gen\\ [Trj] \u00bb FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c",
        "IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure",
        "Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy",
        "RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn ,  Win.Downloader.117423-1 ,",
        "RedTube.com Detections: Win.Trojan.Crypt-321 ,  Win.Trojan.FakeAV-4166 ,  Win.Trojan.Fakeav-10977 ,  Win.Trojan.Fakeav-3386",
        "Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com",
        "Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |",
        "Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/\tphishing\t| https://www.anyxxxtube.net/sitemap.xml",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |",
        "Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com",
        "Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com",
        "Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |",
        "Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com",
        "Crowdstrike: symcd.com [Certificate Subjectaltname \u00bb\u00bb anydesk.com \u00bb\u00bb http://gn.symcb.com/gn.crt Ocsp\thttp://gn.symcd.com] ANYDESK.COM-unsigned",
        "Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606",
        "Crowdstrike: \tbat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey",
        "Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com",
        "Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png",
        "Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257",
        "Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world",
        "Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot",
        "The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse",
        "Above links in search results direct out with and arrow pointing out.",
        "https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente",
        "Above link opened 'esta caliente'=   'it's hot'| I did NOT do that | All connected links gone. This has become common.",
        "I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,",
        "boot.net.anydesk.com removed from my Pulse below",
        "https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Win32:Mystic",
          "display_name": "Win32:Mystic",
          "target": null
        },
        {
          "id": "Win.Trojan.Xblocker-236",
          "display_name": "Win.Trojan.Xblocker-236",
          "target": null
        },
        {
          "id": "Ransom:Win32/Genasom",
          "display_name": "Ransom:Win32/Genasom",
          "target": "/malware/Ransom:Win32/Genasom"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "display_name": "ALF:JASYP:Backdoor:Win32/Cycbot",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Usteal",
          "display_name": "TrojanSpy:Win32/Usteal",
          "target": "/malware/TrojanSpy:Win32/Usteal"
        },
        {
          "id": "Win.Trojan.PoetRat-7669676-0",
          "display_name": "Win.Trojan.PoetRat-7669676-0",
          "target": null
        },
        {
          "id": "Mivast",
          "display_name": "Mivast",
          "target": null
        },
        {
          "id": "Sakula",
          "display_name": "Sakula",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "display_name": "T1021 - Remote Services"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 38,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1417,
        "FileHash-SHA1": 1165,
        "FileHash-SHA256": 6536,
        "URL": 6112,
        "domain": 1340,
        "hostname": 2654,
        "email": 15,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 19248,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "561 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://m.pornmd.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://m.pornmd.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776615381.7057762
}