{
  "type": "URL",
  "indicator": "https://mail02.shareregister.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mail02.shareregister.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3752680886,
      "indicator": "https://mail02.shareregister.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "65cd05cd3c9d0cc0b9ed215f",
          "name": "Emotet - https://www.gambinospizza.com | Brian Sabey \u2022 HallRender",
          "description": "\u2022Emotet botnets were observed dropping Trickbot to deliver ransomware payloads against some victims and Qakbot Trojans to steal banking credentials and data from other targets.\n\n\u2022Scammer 'Attorney' Brian Sabey | HallRender associated ; utilizes every form of social engineering to gain full access to phone numbers, email, banking,  network, relatives, contacts, PHI, PII, modifies services.\n.",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-02-14T18:26:21.427000",
          "tags": [
            "united",
            "unknown",
            "status",
            "sec ch",
            "as44273 host",
            "search",
            "aaaa",
            "showing",
            "ch ua",
            "record value",
            "ssl certificate",
            "threat roundup",
            "contacted",
            "communicating",
            "historical ssl",
            "referrer",
            "resolutions",
            "http",
            "execution",
            "gopher",
            "pattern match",
            "breakpoint",
            "command decode",
            "desktop",
            "base",
            "gambino",
            "pizza",
            "suricata ipv4",
            "mitre att",
            "date",
            "meta",
            "footer",
            "february",
            "general",
            "model",
            "comspec",
            "click",
            "strings",
            "main",
            "brian sabey",
            "hallrender",
            "trojan",
            "worm",
            "frankfurt",
            "germany",
            "asn15169",
            "google",
            "asn16509",
            "amazon02",
            "asn396982",
            "kansas city",
            "franchise url",
            "gmbh version",
            "status page",
            "service privacy",
            "legal",
            "impressum",
            "reverse dns",
            "general full",
            "url https",
            "resource",
            "hash",
            "protocol h2",
            "asn13335",
            "cloudflarenet",
            "software",
            "domains",
            "hashes",
            "learn",
            "issues tab",
            "value",
            "variables",
            "typeof function",
            "topropertykey",
            "bricksintersect",
            "bricksfunction",
            "domainpath name",
            "request chain",
            "chain",
            "nl page",
            "url history",
            "javascript",
            "page url",
            "redirected",
            "poweshell",
            "bruschettab",
            "mobsterstageda",
            "calzonec",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "beefpizzac",
            "superitaliansub",
            "cname",
            "msie",
            "chrome",
            "asnone united",
            "as6336 turn",
            "nxdomain",
            "whitelisted",
            "creation date",
            "turn",
            "body",
            "algorithm",
            "v3 serial",
            "number",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "first",
            "server",
            "registrar abuse",
            "iana id",
            "registrar url",
            "registrar whois",
            "contact email",
            "registry domain",
            "contact phone",
            "dnssec",
            "code",
            "type name",
            "win32 exe",
            "recreation",
            "whois record",
            "infected",
            "page dow",
            "poser",
            "scammer",
            "security",
            "malvertizing",
            "betting",
            "illegal activity",
            "linux",
            "teen porn",
            "child exploitation",
            "script urls",
            "a domains",
            "as10796 charter",
            "find your",
            "next franchise",
            "x content",
            "backend",
            "as13768 aptum",
            "moved",
            "passive dns",
            "urls",
            "as2635",
            "as14061",
            "scan endpoints",
            "all octoseek",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "files location",
            "date hash",
            "avast avg",
            "nastya",
            "entries",
            "emotet",
            "windows nt",
            "show",
            "etpro trojan",
            "channel",
            "artemis",
            "medium",
            "delete",
            "copy",
            "virustotal",
            "trojan",
            "write",
            "trojanproxy",
            "vipre",
            "panda",
            "malware",
            "malware infection",
            "dga",
            "algorithm generated domains",
            "command and control",
            "pe32 executable",
            "tag",
            "tagging",
            "porn tagging",
            "as3356 level",
            "tahoma arial",
            "servers",
            "as1136 kpn",
            "next",
            "et",
            "remote",
            "confirm http",
            "sectrack",
            "openssl",
            "fulldisc",
            "secunia",
            "confirm https",
            "openssl tls",
            "multiple",
            "remote",
            "misc https",
            "impact",
            "heartbleed",
            "external source",
            "name hyperlink",
            "hp hpsbmu02998",
            "hp hpsbmu03019",
            "hp hpsbmu03030",
            "hp hpsbmu03018",
            "title",
            "lowfi",
            "title error",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "mozilla",
            "720.282.2025",
            "masquerading",
            "ninite feb",
            "mtb feb",
            "telper",
            "trojandropper",
            "ninite",
            "create c",
            "read c",
            "default",
            "create",
            "unicode",
            "dock",
            "xport"
          ],
          "references": [
            "www.gambinospizza.com",
            "0qMrDxlbqY9THmtdz56XQ2fTe-p9H49lftTmBXmn1WY9Z16q1vJdZdjO5Wnq_Pn3gEAAP__hu8yPQ",
            "https://apps.apple.com/us/app/gambinos-pizza/id1500338496 \u2022 apps.apple.com",
            "https://play.google.com/store/apps/details?id=com.e9117073d4e0.www",
            "targeting.unrulymedia.com \u2022 http://theteenhealthdoc.com",
            "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
            "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg \u2022 https://www.hallrender.com/xmlrpc.php?rsd",
            "https://teenlist.toplistcreator.eu/in.php?nr=15170//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu",
            "http://fboomporn.com/teens/51826-gloryholeswallow-flora-floras-1st-gloryhole-visit-fullhd-1080p.html \u2022 teenystar18.toplistcreator.eu",
            "theteenhealthdoc.com \u2022 http://jailbait.toplistcreator.eu/link.php?link=teenystar18.toplistcreator.eu&nr=522 \u2022 franchisefifteen.com",
            "https://fboomporn.com/engine/opensearch.php \u2022 http://porn.hub-accessories.site/ \u2022 https://pic.porn.hub-accessories.site",
            "http://porn.toplistcreator.eu/in.php",
            "ETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t85.17.142.7\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t85.17.142.7\t\t\t\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t95.169.186.\t\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t95.169.186.63",
            "Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.10",
            "https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=8.16,2.1\ttag.1rx.io \u2022 192.208.222.110",
            "http://email.acm.mg.hydrantid.com/c/eJxUyTGygyAQBuDTQMksPyhYULzGe-C6LzCKOoYmt88kXdrvWxPlEJ3TkmygcbQBHrokFk-R4WwexpBl-J8Ce8uygBdeJqtrAsGTdWQB8jA0yQDEL0qMrD",
            "CVE-2014-0160 \u2022 CVE-2017-11882",
            "a17-250-248-150.www.bing.com \u2022 appledirectory.www.bing.com",
            "animate-citadel-t3gbc9x3gzd7invrzh8w00zm.herokudns.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Comspec",
              "display_name": "Trojan:Win32/Comspec",
              "target": "/malware/Trojan:Win32/Comspec"
            },
            {
              "id": "XLS:Nastya\\ [Trj]",
              "display_name": "XLS:Nastya\\ [Trj]",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Crypt4.YGM",
              "display_name": "Crypt4.YGM",
              "target": null
            },
            {
              "id": "ZBot",
              "display_name": "ZBot",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Heartbleed Bug",
              "display_name": "Heartbleed Bug",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 59,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 118,
            "FileHash-SHA1": 106,
            "domain": 3271,
            "hostname": 2451,
            "URL": 8652,
            "email": 8,
            "FileHash-SHA256": 3153,
            "CVE": 4
          },
          "indicator_count": 17763,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c7b86fa120d19bbc88f367",
          "name": "Hijacker",
          "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
          "modified": "2024-03-11T17:01:59.026000",
          "created": "2024-02-10T17:54:55.243000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "tsara brashears",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "high level",
            "hackers",
            "hacktool",
            "download",
            "malware",
            "crypto",
            "hijacker",
            "monitoring",
            "installer",
            "tofsee",
            "domains domains",
            "domains files",
            "files files",
            "script",
            "kgs0",
            "kls0",
            "relic",
            "iframe",
            "pe32 executable",
            "ms windows",
            "intel",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "rticon neutral",
            "info compiler",
            "products id",
            "header intel",
            "name md5",
            "contained",
            "type",
            "language",
            "ico rtgroupicon",
            "neutral",
            "first",
            "utc submissions",
            "submitters",
            "company limited",
            "computer",
            "amazonaes",
            "china telecom",
            "group",
            "csc corporate",
            "domains",
            "malware spreading evader",
            "cnc",
            "malvertizing",
            "milehighmedia",
            "trojandropper",
            "moved",
            "passive dns",
            "urls",
            "as14576",
            "backdoor",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "trojan",
            "encrypt",
            "body",
            "date",
            "date hash",
            "avast avg",
            "mtb may",
            "kratona",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls https",
            "script urls",
            "united",
            "meta",
            "unknown",
            "emails",
            "name servers",
            "search",
            "as62597 nsone",
            "a domains",
            "as397241",
            "media",
            "next",
            "december",
            "unlocker",
            "threat round",
            "apple ios",
            "apple phone",
            "project",
            "blister",
            "agent tesla",
            "open",
            "execution",
            "videos",
            "strong",
            "porn videos",
            "watch",
            "daddy",
            "free",
            "top rated",
            "most viewed",
            "cancel anytime",
            "views",
            "play",
            "black",
            "enjoy",
            "czech",
            "hunk",
            "virtool",
            "cryp",
            "creation date",
            "otx telemetry",
            "expiration date",
            "servers",
            "status",
            "win32",
            "showing",
            "domain",
            "nxdomain",
            "as8075",
            "shell code",
            "threat",
            "cyber espionage",
            "cyber stalking",
            "danger",
            "critical",
            "attack",
            "treats",
            "as15169 google",
            "aaaa",
            "record value",
            "error",
            "entries",
            "hostname",
            "url http",
            "http",
            "files domain",
            "files related",
            "shinjiru msc",
            "sdn bhd",
            "dnssec",
            "protect",
            "as54455 madeit",
            "phishing",
            "backdoor",
            "contextualizing",
            "elevated exposure",
            "malvertizing",
            "ransom",
            "msil",
            "hackers for hire",
            "hashes",
            "http method",
            "get http",
            "http requests",
            "get dns",
            "ip traffic",
            "memory pattern",
            "pattern ips",
            "@emreimer",
            "iextract2",
            "cp cyber",
            "denver",
            "security",
            "siem compliance",
            "skip",
            "cybersecurity",
            "larimer st",
            "suite",
            "resources cyber",
            "risk assessment",
            "bill",
            "mind",
            "delaware",
            "pa",
            "arizona",
            "colorado",
            "stalkers",
            "deuteronomy 28:7",
            "hitmen"
          ],
          "references": [
            "honey.exe",
            "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
            "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
            "CS Sigma Rules: Python Initiated Connection by frack113",
            "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
            "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
            "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
            "api.login.live.com",
            "http://appleid.icloud.com-website33.org/",
            "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
            "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
            "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
            "message.htm.com",
            "http://pornhub.com/gay/video/search",
            "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
            "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "W32.Sality.PE",
              "display_name": "W32.Sality.PE",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Virus.Win32.Virut.q",
              "display_name": "Virus.Win32.Virut.q",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32",
              "display_name": "TrojanDropper:Win32",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 54,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6303,
            "FileHash-MD5": 215,
            "FileHash-SHA1": 192,
            "FileHash-SHA256": 2663,
            "domain": 2673,
            "hostname": 2686,
            "CVE": 2,
            "email": 16
          },
          "indicator_count": 14750,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659b0fd1ac7cb4d83834db1f",
          "name": "Botnet Command and Control Server | Malware Distribution Site",
          "description": "",
          "modified": "2024-02-06T20:02:52.205000",
          "created": "2024-01-07T20:55:45.006000",
          "tags": [
            "passive dns",
            "urls",
            "scan endpoints",
            "all octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "status code",
            "body",
            "httponly",
            "ssl certificate",
            "historical ssl",
            "whois record",
            "parent referrer",
            "whois whois",
            "communicating",
            "contacted",
            "contacted urls",
            "bundled",
            "pe resource",
            "dropped",
            "army",
            "machinename",
            "execution",
            "referrer",
            "malware distribution site",
            "phishing dropbox",
            "evasive",
            "banker",
            "dde",
            "dridex",
            "exploit",
            "dyre",
            "dyreza",
            "ransomware",
            "mydoom",
            "backdoor",
            "svg",
            "phising",
            "locky",
            "e-mail provider phishing",
            "spear phishing",
            "retefe",
            "defacement",
            "phishing development bank of singapore",
            "banjori",
            "suppobox",
            "zeus",
            "pony",
            "solar",
            "ransomware locky distribution site",
            "nymaim",
            "shade",
            "troldesh",
            "tvrat",
            "zbot",
            "elocky",
            "wisdomeyes",
            "kryptic",
            "sinkhole",
            "exploit",
            "worm",
            "backdoor",
            "injector",
            "botnet command and control server",
            "unknown",
            "domain",
            "creation date",
            "search",
            "date",
            "hostname",
            "next",
            "all search",
            "otx octoseek",
            "united",
            "as13335",
            "ipv4",
            "pulse submit",
            "url analysis",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "files",
            "nxdomain",
            "win32",
            "meta",
            "wabot",
            "gmt contenttype",
            "dnssec",
            "name",
            "win32 exe",
            "detections file",
            "file size",
            "kb file",
            "domains",
            "registrar",
            "markmonitor inc",
            "status",
            "susp",
            "expiration date",
            "name servers",
            "domain related",
            "entries",
            "johnnsabey",
            "m. brian sabey",
            "mark sabey",
            "sabey data center",
            "utah",
            "http method",
            "http requests",
            "connect http",
            "get dns",
            "resolutions",
            "ip traffic",
            "problems",
            "alienvault part",
            "kgs0",
            "kls0",
            "schema abuse",
            "sneaky server",
            "iframe",
            "apple",
            "data collection"
          ],
          "references": [
            "http://security.didici.cc/cve"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "virus.virlock/nabucur",
              "display_name": "virus.virlock/nabucur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            },
            {
              "id": "Banjori",
              "display_name": "Banjori",
              "target": null
            },
            {
              "id": "Trojan.AvsEtecer",
              "display_name": "Trojan.AvsEtecer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "TV RAT",
              "display_name": "TV RAT",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Dyre",
              "display_name": "Dyre",
              "target": null
            },
            {
              "id": "ELocky",
              "display_name": "ELocky",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Locky (Decryptor)",
              "display_name": "Locky (Decryptor)",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan.WisdomEyes.16070401.9500",
              "display_name": "Trojan.WisdomEyes.16070401.9500",
              "target": null
            },
            {
              "id": "Gen:Variant.Strictor",
              "display_name": "Gen:Variant.Strictor",
              "target": null
            },
            {
              "id": "Adware.BrowseFox",
              "display_name": "Adware.BrowseFox",
              "target": null
            },
            {
              "id": "W32.eHeur",
              "display_name": "W32.eHeur",
              "target": null
            },
            {
              "id": "MSIL_Kryptik.P.gen",
              "display_name": "MSIL_Kryptik.P.gen",
              "target": null
            },
            {
              "id": "pykspa_v2_fake",
              "display_name": "pykspa_v2_fake",
              "target": null
            },
            {
              "id": "Worm:Win32/Pykspa",
              "display_name": "Worm:Win32/Pykspa",
              "target": "/malware/Worm:Win32/Pykspa"
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "TEL:Exploit:Win32/Sinkers",
              "display_name": "TEL:Exploit:Win32/Sinkers",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1594",
              "name": "Search Victim-Owned Websites",
              "display_name": "T1594 - Search Victim-Owned Websites"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 231,
            "FileHash-SHA256": 3121,
            "URL": 4225,
            "domain": 1725,
            "hostname": 1416,
            "FileHash-SHA1": 225,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10948,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a48ab7cd0bd218b17ccf6c",
          "name": "Botnet Command and Control Server | Malware",
          "description": "",
          "modified": "2024-02-06T20:02:52.205000",
          "created": "2024-01-15T01:30:31.655000",
          "tags": [
            "passive dns",
            "urls",
            "scan endpoints",
            "all octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "status code",
            "body",
            "httponly",
            "ssl certificate",
            "historical ssl",
            "whois record",
            "parent referrer",
            "whois whois",
            "communicating",
            "contacted",
            "contacted urls",
            "bundled",
            "pe resource",
            "dropped",
            "army",
            "machinename",
            "execution",
            "referrer",
            "malware distribution site",
            "phishing dropbox",
            "evasive",
            "banker",
            "dde",
            "dridex",
            "exploit",
            "dyre",
            "dyreza",
            "ransomware",
            "mydoom",
            "backdoor",
            "svg",
            "phising",
            "locky",
            "e-mail provider phishing",
            "spear phishing",
            "retefe",
            "defacement",
            "phishing development bank of singapore",
            "banjori",
            "suppobox",
            "zeus",
            "pony",
            "solar",
            "ransomware locky distribution site",
            "nymaim",
            "shade",
            "troldesh",
            "tvrat",
            "zbot",
            "elocky",
            "wisdomeyes",
            "kryptic",
            "sinkhole",
            "exploit",
            "worm",
            "backdoor",
            "injector",
            "botnet command and control server",
            "unknown",
            "domain",
            "creation date",
            "search",
            "date",
            "hostname",
            "next",
            "all search",
            "otx octoseek",
            "united",
            "as13335",
            "ipv4",
            "pulse submit",
            "url analysis",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "files",
            "nxdomain",
            "win32",
            "meta",
            "wabot",
            "gmt contenttype",
            "dnssec",
            "name",
            "win32 exe",
            "detections file",
            "file size",
            "kb file",
            "domains",
            "registrar",
            "markmonitor inc",
            "status",
            "susp",
            "expiration date",
            "name servers",
            "domain related",
            "entries",
            "johnnsabey",
            "m. brian sabey",
            "mark sabey",
            "sabey data center",
            "utah",
            "http method",
            "http requests",
            "connect http",
            "get dns",
            "resolutions",
            "ip traffic",
            "problems",
            "alienvault part",
            "kgs0",
            "kls0",
            "schema abuse",
            "sneaky server",
            "iframe",
            "apple",
            "data collection"
          ],
          "references": [
            "http://security.didici.cc/cve"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "virus.virlock/nabucur",
              "display_name": "virus.virlock/nabucur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            },
            {
              "id": "Banjori",
              "display_name": "Banjori",
              "target": null
            },
            {
              "id": "Trojan.AvsEtecer",
              "display_name": "Trojan.AvsEtecer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "TV RAT",
              "display_name": "TV RAT",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Dyre",
              "display_name": "Dyre",
              "target": null
            },
            {
              "id": "ELocky",
              "display_name": "ELocky",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Locky (Decryptor)",
              "display_name": "Locky (Decryptor)",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan.WisdomEyes.16070401.9500",
              "display_name": "Trojan.WisdomEyes.16070401.9500",
              "target": null
            },
            {
              "id": "Gen:Variant.Strictor",
              "display_name": "Gen:Variant.Strictor",
              "target": null
            },
            {
              "id": "Adware.BrowseFox",
              "display_name": "Adware.BrowseFox",
              "target": null
            },
            {
              "id": "W32.eHeur",
              "display_name": "W32.eHeur",
              "target": null
            },
            {
              "id": "MSIL_Kryptik.P.gen",
              "display_name": "MSIL_Kryptik.P.gen",
              "target": null
            },
            {
              "id": "pykspa_v2_fake",
              "display_name": "pykspa_v2_fake",
              "target": null
            },
            {
              "id": "Worm:Win32/Pykspa",
              "display_name": "Worm:Win32/Pykspa",
              "target": "/malware/Worm:Win32/Pykspa"
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "TEL:Exploit:Win32/Sinkers",
              "display_name": "TEL:Exploit:Win32/Sinkers",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1594",
              "name": "Search Victim-Owned Websites",
              "display_name": "T1594 - Search Victim-Owned Websites"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659b0fd1ac7cb4d83834db1f",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 231,
            "FileHash-SHA256": 3121,
            "URL": 4225,
            "domain": 1725,
            "hostname": 1416,
            "FileHash-SHA1": 225,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10948,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655b9a90e44a70d0fbbde981",
          "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
          "description": "Domain stated ' SEIZED' by Departing Homeland Security\nSeizure links below seem a bit questionable: \n\nhttp://server3.elgenero.com/iprc_seized_banner.png\nhttp://kickass.to/IPRC_Seized_2016_kat.jpg\nhttp://kickass.to/the-adventures-of-tom-sawyer-t2068537.html\t\nhttp://bludv.tv/iprc_seized_banner.png\nhttp://z-lib.org/iprc_seized_banner.png\nIPRC_Seized_2016_kat.jpg\n... just banners? Moved and continue? Okay.\nListed below also listed in seized domain. Domains,URL's and Botnetwork Hosts still seem to exist.\nhttp://alohatube.xyz/search/tsara-brashears\nalohatube.xyz\nhttps://alohatube.xyz/search/tsara-brashears\nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/\nhttp://45.159.189.105/bot/regex\t\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbia\t\nnr-data.net",
          "modified": "2023-12-20T17:01:34.161000",
          "created": "2023-11-20T17:42:40.771000",
          "tags": [
            "safe site",
            "million",
            "cisco umbrella",
            "alexa top",
            "site",
            "tag count",
            "tld count",
            "jul jan",
            "team alexa",
            "count blacklist",
            "maltiverse",
            "redirme",
            "cronup threat",
            "intel malware",
            "malicious site",
            "malware",
            "no data",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "united",
            "cyber threat",
            "engineering",
            "team",
            "malware site",
            "covid19",
            "phishing site",
            "phishing",
            "phishtank",
            "bank",
            "zbot",
            "malicious",
            "download",
            "suppobox",
            "zeus",
            "nymaim",
            "matsnu",
            "artemis",
            "virut",
            "panama",
            "smsspy",
            "cobalt strike",
            "emotet",
            "bradesco",
            "stealer",
            "facebook",
            "service",
            "simda",
            "runescape",
            "cutwail",
            "unruy",
            "bandoo",
            "tinba",
            "pykspa",
            "domaiq",
            "ave maria",
            "citadel",
            "pony",
            "keitaro",
            "ponmocup",
            "ransomware",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "sha256",
            "sha1",
            "ascii text",
            "date",
            "unknown",
            "body",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "malicious url",
            "union",
            "unsafe",
            "node tcp",
            "traffic",
            "tor known",
            "tor relayrouter",
            "spammer",
            "threats et",
            "ssl certificate",
            "contacted",
            "whois record",
            "whois whois",
            "historical ssl",
            "apple ios",
            "resolutions",
            "bundled",
            "referrer",
            "collections",
            "android",
            "banker",
            "keylogger",
            "generic malware",
            "generic",
            "blacklist http",
            "ac32a",
            "heur",
            "alexa",
            "xtrat",
            "iframe",
            "installcore",
            "win64",
            "crack",
            "xrat",
            "nircmd",
            "swrort",
            "agent",
            "filetour",
            "cleaner",
            "patcher",
            "adload",
            "wacatac",
            "riskware",
            "acint",
            "conduit",
            "fakealert",
            "opencandy",
            "xtreme",
            "downldr",
            "outbreak",
            "iobit",
            "rostpay",
            "dropper",
            "mediaget",
            "installpack",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "presenoker",
            "fusioncore",
            "exploit",
            "filerepmetagen",
            "download json",
            "hostname",
            "hostnames",
            "mail spammer",
            "anonymizer",
            "firehol proxy",
            "asyncrat",
            "genkryptik",
            "fuery",
            "webtoolbar",
            "trojanspy",
            "dropped",
            "execution",
            "contacted urls",
            "http spammer",
            "host",
            "ip address",
            "site top",
            "site safe",
            "blacklist https",
            "tsara brashears",
            "kgs0",
            "kls0",
            "critical risk",
            "attack",
            "hacktool",
            "installer"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Latvia",
            "Poland",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 46,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1117,
            "FileHash-SHA1": 664,
            "FileHash-SHA256": 3426,
            "domain": 977,
            "hostname": 2269,
            "URL": 5554,
            "CVE": 23,
            "URI": 8,
            "Mutex": 1
          },
          "indicator_count": 14039,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "851 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a9c2eeebaf7b69d0e12ba",
          "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
          "description": "",
          "modified": "2023-12-20T17:01:34.161000",
          "created": "2023-12-02T02:53:34.585000",
          "tags": [
            "safe site",
            "million",
            "cisco umbrella",
            "alexa top",
            "site",
            "tag count",
            "tld count",
            "jul jan",
            "team alexa",
            "count blacklist",
            "maltiverse",
            "redirme",
            "cronup threat",
            "intel malware",
            "malicious site",
            "malware",
            "no data",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "united",
            "cyber threat",
            "engineering",
            "team",
            "malware site",
            "covid19",
            "phishing site",
            "phishing",
            "phishtank",
            "bank",
            "zbot",
            "malicious",
            "download",
            "suppobox",
            "zeus",
            "nymaim",
            "matsnu",
            "artemis",
            "virut",
            "panama",
            "smsspy",
            "cobalt strike",
            "emotet",
            "bradesco",
            "stealer",
            "facebook",
            "service",
            "simda",
            "runescape",
            "cutwail",
            "unruy",
            "bandoo",
            "tinba",
            "pykspa",
            "domaiq",
            "ave maria",
            "citadel",
            "pony",
            "keitaro",
            "ponmocup",
            "ransomware",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "sha256",
            "sha1",
            "ascii text",
            "date",
            "unknown",
            "body",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "malicious url",
            "union",
            "unsafe",
            "node tcp",
            "traffic",
            "tor known",
            "tor relayrouter",
            "spammer",
            "threats et",
            "ssl certificate",
            "contacted",
            "whois record",
            "whois whois",
            "historical ssl",
            "apple ios",
            "resolutions",
            "bundled",
            "referrer",
            "collections",
            "android",
            "banker",
            "keylogger",
            "generic malware",
            "generic",
            "blacklist http",
            "ac32a",
            "heur",
            "alexa",
            "xtrat",
            "iframe",
            "installcore",
            "win64",
            "crack",
            "xrat",
            "nircmd",
            "swrort",
            "agent",
            "filetour",
            "cleaner",
            "patcher",
            "adload",
            "wacatac",
            "riskware",
            "acint",
            "conduit",
            "fakealert",
            "opencandy",
            "xtreme",
            "downldr",
            "outbreak",
            "iobit",
            "rostpay",
            "dropper",
            "mediaget",
            "installpack",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "presenoker",
            "fusioncore",
            "exploit",
            "filerepmetagen",
            "download json",
            "hostname",
            "hostnames",
            "mail spammer",
            "anonymizer",
            "firehol proxy",
            "asyncrat",
            "genkryptik",
            "fuery",
            "webtoolbar",
            "trojanspy",
            "dropped",
            "execution",
            "contacted urls",
            "http spammer",
            "host",
            "ip address",
            "site top",
            "site safe",
            "blacklist https",
            "tsara brashears",
            "kgs0",
            "kls0",
            "critical risk",
            "attack",
            "hacktool",
            "installer"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Latvia",
            "Poland",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655b9a90e44a70d0fbbde981",
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1117,
            "FileHash-SHA1": 664,
            "FileHash-SHA256": 3426,
            "domain": 977,
            "hostname": 2269,
            "URL": 5554,
            "CVE": 23,
            "URI": 8,
            "Mutex": 1
          },
          "indicator_count": 14039,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "851 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "CVE-2014-0160 \u2022 CVE-2017-11882",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
        "Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.10",
        "honey.exe",
        "ETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t85.17.142.7\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t85.17.142.7\t\t\t\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t95.169.186.\t\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t95.169.186.63",
        "https://fboomporn.com/engine/opensearch.php \u2022 http://porn.hub-accessories.site/ \u2022 https://pic.porn.hub-accessories.site",
        "https://play.google.com/store/apps/details?id=com.e9117073d4e0.www",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://apps.apple.com/us/app/gambinos-pizza/id1500338496 \u2022 apps.apple.com",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "api.login.live.com",
        "www.gambinospizza.com",
        "http://security.didici.cc/cve",
        "http://email.acm.mg.hydrantid.com/c/eJxUyTGygyAQBuDTQMksPyhYULzGe-C6LzCKOoYmt88kXdrvWxPlEJ3TkmygcbQBHrokFk-R4WwexpBl-J8Ce8uygBdeJqtrAsGTdWQB8jA0yQDEL0qMrD",
        "a17-250-248-150.www.bing.com \u2022 appledirectory.www.bing.com",
        "message.htm.com",
        "http://fboomporn.com/teens/51826-gloryholeswallow-flora-floras-1st-gloryhole-visit-fullhd-1080p.html \u2022 teenystar18.toplistcreator.eu",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "targeting.unrulymedia.com \u2022 http://theteenhealthdoc.com",
        "theteenhealthdoc.com \u2022 http://jailbait.toplistcreator.eu/link.php?link=teenystar18.toplistcreator.eu&nr=522 \u2022 franchisefifteen.com",
        "http://appleid.icloud.com-website33.org/",
        "http://pornhub.com/gay/video/search",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
        "http://porn.toplistcreator.eu/in.php",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg \u2022 https://www.hallrender.com/xmlrpc.php?rsd",
        "https://teenlist.toplistcreator.eu/in.php?nr=15170//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "0qMrDxlbqY9THmtdz56XQ2fTe-p9H49lftTmBXmn1WY9Z16q1vJdZdjO5Wnq_Pn3gEAAP__hu8yPQ",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=8.16,2.1\ttag.1rx.io \u2022 192.208.222.110",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "animate-citadel-t3gbc9x3gzd7invrzh8w00zm.herokudns.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Suppobox",
            "Emotet",
            "Heartbleed bug",
            "Virus.virlock/nabucur",
            "W32.sality.pe",
            "Hacktool",
            "Trojan.avsetecer",
            "Banjori",
            "Xls:nastya\\ [trj]",
            "Dyre",
            "Generic",
            "Trojan:win32/comspec",
            "Tel:exploit:win32/sinkers",
            "Virtool",
            "Mydoom",
            "Solar",
            "Relic",
            "Pony",
            "Nymaim",
            "Dridex",
            "W32.eheur",
            "Hallrender",
            "Pykspa",
            "Et",
            "Crypt4.ygm",
            "Elocky",
            "Adware.browsefox",
            "Trojandropper:win32",
            "Virus.win32.virut.q",
            "Msil_kryptik.p.gen",
            "Zeus",
            "Virut",
            "Defacement",
            "Zbot",
            "Locky (decryptor)",
            "Ransomware",
            "Tofsee",
            "Gen:variant.strictor",
            "Worm:win32/pykspa",
            "Trojanspy",
            "Trojan.wisdomeyes.16070401.9500",
            "Sabey",
            "Tv rat",
            "Locky",
            "Pykspa_v2_fake",
            "Webtoolbar"
          ],
          "industries": [],
          "unique_indicators": 56077
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/shareregister.com",
    "whois": "http://whois.domaintools.com/shareregister.com",
    "domain": "shareregister.com",
    "hostname": "mail02.shareregister.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "65cd05cd3c9d0cc0b9ed215f",
      "name": "Emotet - https://www.gambinospizza.com | Brian Sabey \u2022 HallRender",
      "description": "\u2022Emotet botnets were observed dropping Trickbot to deliver ransomware payloads against some victims and Qakbot Trojans to steal banking credentials and data from other targets.\n\n\u2022Scammer 'Attorney' Brian Sabey | HallRender associated ; utilizes every form of social engineering to gain full access to phone numbers, email, banking,  network, relatives, contacts, PHI, PII, modifies services.\n.",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-02-14T18:26:21.427000",
      "tags": [
        "united",
        "unknown",
        "status",
        "sec ch",
        "as44273 host",
        "search",
        "aaaa",
        "showing",
        "ch ua",
        "record value",
        "ssl certificate",
        "threat roundup",
        "contacted",
        "communicating",
        "historical ssl",
        "referrer",
        "resolutions",
        "http",
        "execution",
        "gopher",
        "pattern match",
        "breakpoint",
        "command decode",
        "desktop",
        "base",
        "gambino",
        "pizza",
        "suricata ipv4",
        "mitre att",
        "date",
        "meta",
        "footer",
        "february",
        "general",
        "model",
        "comspec",
        "click",
        "strings",
        "main",
        "brian sabey",
        "hallrender",
        "trojan",
        "worm",
        "frankfurt",
        "germany",
        "asn15169",
        "google",
        "asn16509",
        "amazon02",
        "asn396982",
        "kansas city",
        "franchise url",
        "gmbh version",
        "status page",
        "service privacy",
        "legal",
        "impressum",
        "reverse dns",
        "general full",
        "url https",
        "resource",
        "hash",
        "protocol h2",
        "asn13335",
        "cloudflarenet",
        "software",
        "domains",
        "hashes",
        "learn",
        "issues tab",
        "value",
        "variables",
        "typeof function",
        "topropertykey",
        "bricksintersect",
        "bricksfunction",
        "domainpath name",
        "request chain",
        "chain",
        "nl page",
        "url history",
        "javascript",
        "page url",
        "redirected",
        "poweshell",
        "bruschettab",
        "mobsterstageda",
        "calzonec",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "beefpizzac",
        "superitaliansub",
        "cname",
        "msie",
        "chrome",
        "asnone united",
        "as6336 turn",
        "nxdomain",
        "whitelisted",
        "creation date",
        "turn",
        "body",
        "algorithm",
        "v3 serial",
        "number",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "x509v3 extended",
        "info",
        "first",
        "server",
        "registrar abuse",
        "iana id",
        "registrar url",
        "registrar whois",
        "contact email",
        "registry domain",
        "contact phone",
        "dnssec",
        "code",
        "type name",
        "win32 exe",
        "recreation",
        "whois record",
        "infected",
        "page dow",
        "poser",
        "scammer",
        "security",
        "malvertizing",
        "betting",
        "illegal activity",
        "linux",
        "teen porn",
        "child exploitation",
        "script urls",
        "a domains",
        "as10796 charter",
        "find your",
        "next franchise",
        "x content",
        "backend",
        "as13768 aptum",
        "moved",
        "passive dns",
        "urls",
        "as2635",
        "as14061",
        "scan endpoints",
        "all octoseek",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "files location",
        "date hash",
        "avast avg",
        "nastya",
        "entries",
        "emotet",
        "windows nt",
        "show",
        "etpro trojan",
        "channel",
        "artemis",
        "medium",
        "delete",
        "copy",
        "virustotal",
        "trojan",
        "write",
        "trojanproxy",
        "vipre",
        "panda",
        "malware",
        "malware infection",
        "dga",
        "algorithm generated domains",
        "command and control",
        "pe32 executable",
        "tag",
        "tagging",
        "porn tagging",
        "as3356 level",
        "tahoma arial",
        "servers",
        "as1136 kpn",
        "next",
        "et",
        "remote",
        "confirm http",
        "sectrack",
        "openssl",
        "fulldisc",
        "secunia",
        "confirm https",
        "openssl tls",
        "multiple",
        "remote",
        "misc https",
        "impact",
        "heartbleed",
        "external source",
        "name hyperlink",
        "hp hpsbmu02998",
        "hp hpsbmu03019",
        "hp hpsbmu03030",
        "hp hpsbmu03018",
        "title",
        "lowfi",
        "title error",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "mozilla",
        "720.282.2025",
        "masquerading",
        "ninite feb",
        "mtb feb",
        "telper",
        "trojandropper",
        "ninite",
        "create c",
        "read c",
        "default",
        "create",
        "unicode",
        "dock",
        "xport"
      ],
      "references": [
        "www.gambinospizza.com",
        "0qMrDxlbqY9THmtdz56XQ2fTe-p9H49lftTmBXmn1WY9Z16q1vJdZdjO5Wnq_Pn3gEAAP__hu8yPQ",
        "https://apps.apple.com/us/app/gambinos-pizza/id1500338496 \u2022 apps.apple.com",
        "https://play.google.com/store/apps/details?id=com.e9117073d4e0.www",
        "targeting.unrulymedia.com \u2022 http://theteenhealthdoc.com",
        "https://www.hallrender.com/attorney/brian-sabey/ \u2022 www.hallrender.com \u2022 https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
        "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg \u2022 https://www.hallrender.com/xmlrpc.php?rsd",
        "https://teenlist.toplistcreator.eu/in.php?nr=15170//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu//www.toplistcreator.eu",
        "http://fboomporn.com/teens/51826-gloryholeswallow-flora-floras-1st-gloryhole-visit-fullhd-1080p.html \u2022 teenystar18.toplistcreator.eu",
        "theteenhealthdoc.com \u2022 http://jailbait.toplistcreator.eu/link.php?link=teenystar18.toplistcreator.eu&nr=522 \u2022 franchisefifteen.com",
        "https://fboomporn.com/engine/opensearch.php \u2022 http://porn.hub-accessories.site/ \u2022 https://pic.porn.hub-accessories.site",
        "http://porn.toplistcreator.eu/in.php",
        "ETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t85.17.142.7\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t85.17.142.7\t\t\t\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t95.169.186.\t\t 2807561\tETPRO TROJAN Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.103\t95.169.186.63",
        "Trojan/Win32.Zbot Covert Channel 2 port 53\t192.168.56.10",
        "https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=8.16,2.1\ttag.1rx.io \u2022 192.208.222.110",
        "http://email.acm.mg.hydrantid.com/c/eJxUyTGygyAQBuDTQMksPyhYULzGe-C6LzCKOoYmt88kXdrvWxPlEJ3TkmygcbQBHrokFk-R4WwexpBl-J8Ce8uygBdeJqtrAsGTdWQB8jA0yQDEL0qMrD",
        "CVE-2014-0160 \u2022 CVE-2017-11882",
        "a17-250-248-150.www.bing.com \u2022 appledirectory.www.bing.com",
        "animate-citadel-t3gbc9x3gzd7invrzh8w00zm.herokudns.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Comspec",
          "display_name": "Trojan:Win32/Comspec",
          "target": "/malware/Trojan:Win32/Comspec"
        },
        {
          "id": "XLS:Nastya\\ [Trj]",
          "display_name": "XLS:Nastya\\ [Trj]",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Crypt4.YGM",
          "display_name": "Crypt4.YGM",
          "target": null
        },
        {
          "id": "ZBot",
          "display_name": "ZBot",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Heartbleed Bug",
          "display_name": "Heartbleed Bug",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 59,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 118,
        "FileHash-SHA1": 106,
        "domain": 3271,
        "hostname": 2451,
        "URL": 8652,
        "email": 8,
        "FileHash-SHA256": 3153,
        "CVE": 4
      },
      "indicator_count": 17763,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c7b86fa120d19bbc88f367",
      "name": "Hijacker",
      "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
      "modified": "2024-03-11T17:01:59.026000",
      "created": "2024-02-10T17:54:55.243000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "tsara brashears",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "high level",
        "hackers",
        "hacktool",
        "download",
        "malware",
        "crypto",
        "hijacker",
        "monitoring",
        "installer",
        "tofsee",
        "domains domains",
        "domains files",
        "files files",
        "script",
        "kgs0",
        "kls0",
        "relic",
        "iframe",
        "pe32 executable",
        "ms windows",
        "intel",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "rticon neutral",
        "info compiler",
        "products id",
        "header intel",
        "name md5",
        "contained",
        "type",
        "language",
        "ico rtgroupicon",
        "neutral",
        "first",
        "utc submissions",
        "submitters",
        "company limited",
        "computer",
        "amazonaes",
        "china telecom",
        "group",
        "csc corporate",
        "domains",
        "malware spreading evader",
        "cnc",
        "malvertizing",
        "milehighmedia",
        "trojandropper",
        "moved",
        "passive dns",
        "urls",
        "as14576",
        "backdoor",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "trojan",
        "encrypt",
        "body",
        "date",
        "date hash",
        "avast avg",
        "mtb may",
        "kratona",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "urls https",
        "script urls",
        "united",
        "meta",
        "unknown",
        "emails",
        "name servers",
        "search",
        "as62597 nsone",
        "a domains",
        "as397241",
        "media",
        "next",
        "december",
        "unlocker",
        "threat round",
        "apple ios",
        "apple phone",
        "project",
        "blister",
        "agent tesla",
        "open",
        "execution",
        "videos",
        "strong",
        "porn videos",
        "watch",
        "daddy",
        "free",
        "top rated",
        "most viewed",
        "cancel anytime",
        "views",
        "play",
        "black",
        "enjoy",
        "czech",
        "hunk",
        "virtool",
        "cryp",
        "creation date",
        "otx telemetry",
        "expiration date",
        "servers",
        "status",
        "win32",
        "showing",
        "domain",
        "nxdomain",
        "as8075",
        "shell code",
        "threat",
        "cyber espionage",
        "cyber stalking",
        "danger",
        "critical",
        "attack",
        "treats",
        "as15169 google",
        "aaaa",
        "record value",
        "error",
        "entries",
        "hostname",
        "url http",
        "http",
        "files domain",
        "files related",
        "shinjiru msc",
        "sdn bhd",
        "dnssec",
        "protect",
        "as54455 madeit",
        "phishing",
        "backdoor",
        "contextualizing",
        "elevated exposure",
        "malvertizing",
        "ransom",
        "msil",
        "hackers for hire",
        "hashes",
        "http method",
        "get http",
        "http requests",
        "get dns",
        "ip traffic",
        "memory pattern",
        "pattern ips",
        "@emreimer",
        "iextract2",
        "cp cyber",
        "denver",
        "security",
        "siem compliance",
        "skip",
        "cybersecurity",
        "larimer st",
        "suite",
        "resources cyber",
        "risk assessment",
        "bill",
        "mind",
        "delaware",
        "pa",
        "arizona",
        "colorado",
        "stalkers",
        "deuteronomy 28:7",
        "hitmen"
      ],
      "references": [
        "honey.exe",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "api.login.live.com",
        "http://appleid.icloud.com-website33.org/",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "message.htm.com",
        "http://pornhub.com/gay/video/search",
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "W32.Sality.PE",
          "display_name": "W32.Sality.PE",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Virus.Win32.Virut.q",
          "display_name": "Virus.Win32.Virut.q",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32",
          "display_name": "TrojanDropper:Win32",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 54,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6303,
        "FileHash-MD5": 215,
        "FileHash-SHA1": 192,
        "FileHash-SHA256": 2663,
        "domain": 2673,
        "hostname": 2686,
        "CVE": 2,
        "email": 16
      },
      "indicator_count": 14750,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659b0fd1ac7cb4d83834db1f",
      "name": "Botnet Command and Control Server | Malware Distribution Site",
      "description": "",
      "modified": "2024-02-06T20:02:52.205000",
      "created": "2024-01-07T20:55:45.006000",
      "tags": [
        "passive dns",
        "urls",
        "scan endpoints",
        "all octoseek",
        "url http",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "status code",
        "body",
        "httponly",
        "ssl certificate",
        "historical ssl",
        "whois record",
        "parent referrer",
        "whois whois",
        "communicating",
        "contacted",
        "contacted urls",
        "bundled",
        "pe resource",
        "dropped",
        "army",
        "machinename",
        "execution",
        "referrer",
        "malware distribution site",
        "phishing dropbox",
        "evasive",
        "banker",
        "dde",
        "dridex",
        "exploit",
        "dyre",
        "dyreza",
        "ransomware",
        "mydoom",
        "backdoor",
        "svg",
        "phising",
        "locky",
        "e-mail provider phishing",
        "spear phishing",
        "retefe",
        "defacement",
        "phishing development bank of singapore",
        "banjori",
        "suppobox",
        "zeus",
        "pony",
        "solar",
        "ransomware locky distribution site",
        "nymaim",
        "shade",
        "troldesh",
        "tvrat",
        "zbot",
        "elocky",
        "wisdomeyes",
        "kryptic",
        "sinkhole",
        "exploit",
        "worm",
        "backdoor",
        "injector",
        "botnet command and control server",
        "unknown",
        "domain",
        "creation date",
        "search",
        "date",
        "hostname",
        "next",
        "all search",
        "otx octoseek",
        "united",
        "as13335",
        "ipv4",
        "pulse submit",
        "url analysis",
        "iocs",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "files",
        "nxdomain",
        "win32",
        "meta",
        "wabot",
        "gmt contenttype",
        "dnssec",
        "name",
        "win32 exe",
        "detections file",
        "file size",
        "kb file",
        "domains",
        "registrar",
        "markmonitor inc",
        "status",
        "susp",
        "expiration date",
        "name servers",
        "domain related",
        "entries",
        "johnnsabey",
        "m. brian sabey",
        "mark sabey",
        "sabey data center",
        "utah",
        "http method",
        "http requests",
        "connect http",
        "get dns",
        "resolutions",
        "ip traffic",
        "problems",
        "alienvault part",
        "kgs0",
        "kls0",
        "schema abuse",
        "sneaky server",
        "iframe",
        "apple",
        "data collection"
      ],
      "references": [
        "http://security.didici.cc/cve"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "virus.virlock/nabucur",
          "display_name": "virus.virlock/nabucur",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "Locky",
          "display_name": "Locky",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        },
        {
          "id": "Banjori",
          "display_name": "Banjori",
          "target": null
        },
        {
          "id": "Trojan.AvsEtecer",
          "display_name": "Trojan.AvsEtecer",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "ZeuS",
          "display_name": "ZeuS",
          "target": null
        },
        {
          "id": "Pony",
          "display_name": "Pony",
          "target": null
        },
        {
          "id": "Solar",
          "display_name": "Solar",
          "target": null
        },
        {
          "id": "Nymaim",
          "display_name": "Nymaim",
          "target": null
        },
        {
          "id": "TV RAT",
          "display_name": "TV RAT",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Dyre",
          "display_name": "Dyre",
          "target": null
        },
        {
          "id": "ELocky",
          "display_name": "ELocky",
          "target": null
        },
        {
          "id": "Dridex",
          "display_name": "Dridex",
          "target": null
        },
        {
          "id": "Locky (Decryptor)",
          "display_name": "Locky (Decryptor)",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Trojan.WisdomEyes.16070401.9500",
          "display_name": "Trojan.WisdomEyes.16070401.9500",
          "target": null
        },
        {
          "id": "Gen:Variant.Strictor",
          "display_name": "Gen:Variant.Strictor",
          "target": null
        },
        {
          "id": "Adware.BrowseFox",
          "display_name": "Adware.BrowseFox",
          "target": null
        },
        {
          "id": "W32.eHeur",
          "display_name": "W32.eHeur",
          "target": null
        },
        {
          "id": "MSIL_Kryptik.P.gen",
          "display_name": "MSIL_Kryptik.P.gen",
          "target": null
        },
        {
          "id": "pykspa_v2_fake",
          "display_name": "pykspa_v2_fake",
          "target": null
        },
        {
          "id": "Worm:Win32/Pykspa",
          "display_name": "Worm:Win32/Pykspa",
          "target": "/malware/Worm:Win32/Pykspa"
        },
        {
          "id": "Pykspa",
          "display_name": "Pykspa",
          "target": null
        },
        {
          "id": "TEL:Exploit:Win32/Sinkers",
          "display_name": "TEL:Exploit:Win32/Sinkers",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1594",
          "name": "Search Victim-Owned Websites",
          "display_name": "T1594 - Search Victim-Owned Websites"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1114.002",
          "name": "Remote Email Collection",
          "display_name": "T1114.002 - Remote Email Collection"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 231,
        "FileHash-SHA256": 3121,
        "URL": 4225,
        "domain": 1725,
        "hostname": 1416,
        "FileHash-SHA1": 225,
        "CVE": 2,
        "email": 3
      },
      "indicator_count": 10948,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a48ab7cd0bd218b17ccf6c",
      "name": "Botnet Command and Control Server | Malware",
      "description": "",
      "modified": "2024-02-06T20:02:52.205000",
      "created": "2024-01-15T01:30:31.655000",
      "tags": [
        "passive dns",
        "urls",
        "scan endpoints",
        "all octoseek",
        "url http",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "status code",
        "body",
        "httponly",
        "ssl certificate",
        "historical ssl",
        "whois record",
        "parent referrer",
        "whois whois",
        "communicating",
        "contacted",
        "contacted urls",
        "bundled",
        "pe resource",
        "dropped",
        "army",
        "machinename",
        "execution",
        "referrer",
        "malware distribution site",
        "phishing dropbox",
        "evasive",
        "banker",
        "dde",
        "dridex",
        "exploit",
        "dyre",
        "dyreza",
        "ransomware",
        "mydoom",
        "backdoor",
        "svg",
        "phising",
        "locky",
        "e-mail provider phishing",
        "spear phishing",
        "retefe",
        "defacement",
        "phishing development bank of singapore",
        "banjori",
        "suppobox",
        "zeus",
        "pony",
        "solar",
        "ransomware locky distribution site",
        "nymaim",
        "shade",
        "troldesh",
        "tvrat",
        "zbot",
        "elocky",
        "wisdomeyes",
        "kryptic",
        "sinkhole",
        "exploit",
        "worm",
        "backdoor",
        "injector",
        "botnet command and control server",
        "unknown",
        "domain",
        "creation date",
        "search",
        "date",
        "hostname",
        "next",
        "all search",
        "otx octoseek",
        "united",
        "as13335",
        "ipv4",
        "pulse submit",
        "url analysis",
        "iocs",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "files",
        "nxdomain",
        "win32",
        "meta",
        "wabot",
        "gmt contenttype",
        "dnssec",
        "name",
        "win32 exe",
        "detections file",
        "file size",
        "kb file",
        "domains",
        "registrar",
        "markmonitor inc",
        "status",
        "susp",
        "expiration date",
        "name servers",
        "domain related",
        "entries",
        "johnnsabey",
        "m. brian sabey",
        "mark sabey",
        "sabey data center",
        "utah",
        "http method",
        "http requests",
        "connect http",
        "get dns",
        "resolutions",
        "ip traffic",
        "problems",
        "alienvault part",
        "kgs0",
        "kls0",
        "schema abuse",
        "sneaky server",
        "iframe",
        "apple",
        "data collection"
      ],
      "references": [
        "http://security.didici.cc/cve"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "virus.virlock/nabucur",
          "display_name": "virus.virlock/nabucur",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "Locky",
          "display_name": "Locky",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        },
        {
          "id": "Banjori",
          "display_name": "Banjori",
          "target": null
        },
        {
          "id": "Trojan.AvsEtecer",
          "display_name": "Trojan.AvsEtecer",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "ZeuS",
          "display_name": "ZeuS",
          "target": null
        },
        {
          "id": "Pony",
          "display_name": "Pony",
          "target": null
        },
        {
          "id": "Solar",
          "display_name": "Solar",
          "target": null
        },
        {
          "id": "Nymaim",
          "display_name": "Nymaim",
          "target": null
        },
        {
          "id": "TV RAT",
          "display_name": "TV RAT",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Dyre",
          "display_name": "Dyre",
          "target": null
        },
        {
          "id": "ELocky",
          "display_name": "ELocky",
          "target": null
        },
        {
          "id": "Dridex",
          "display_name": "Dridex",
          "target": null
        },
        {
          "id": "Locky (Decryptor)",
          "display_name": "Locky (Decryptor)",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Trojan.WisdomEyes.16070401.9500",
          "display_name": "Trojan.WisdomEyes.16070401.9500",
          "target": null
        },
        {
          "id": "Gen:Variant.Strictor",
          "display_name": "Gen:Variant.Strictor",
          "target": null
        },
        {
          "id": "Adware.BrowseFox",
          "display_name": "Adware.BrowseFox",
          "target": null
        },
        {
          "id": "W32.eHeur",
          "display_name": "W32.eHeur",
          "target": null
        },
        {
          "id": "MSIL_Kryptik.P.gen",
          "display_name": "MSIL_Kryptik.P.gen",
          "target": null
        },
        {
          "id": "pykspa_v2_fake",
          "display_name": "pykspa_v2_fake",
          "target": null
        },
        {
          "id": "Worm:Win32/Pykspa",
          "display_name": "Worm:Win32/Pykspa",
          "target": "/malware/Worm:Win32/Pykspa"
        },
        {
          "id": "Pykspa",
          "display_name": "Pykspa",
          "target": null
        },
        {
          "id": "TEL:Exploit:Win32/Sinkers",
          "display_name": "TEL:Exploit:Win32/Sinkers",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1594",
          "name": "Search Victim-Owned Websites",
          "display_name": "T1594 - Search Victim-Owned Websites"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1114.002",
          "name": "Remote Email Collection",
          "display_name": "T1114.002 - Remote Email Collection"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659b0fd1ac7cb4d83834db1f",
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 231,
        "FileHash-SHA256": 3121,
        "URL": 4225,
        "domain": 1725,
        "hostname": 1416,
        "FileHash-SHA1": 225,
        "CVE": 2,
        "email": 3
      },
      "indicator_count": 10948,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655b9a90e44a70d0fbbde981",
      "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
      "description": "Domain stated ' SEIZED' by Departing Homeland Security\nSeizure links below seem a bit questionable: \n\nhttp://server3.elgenero.com/iprc_seized_banner.png\nhttp://kickass.to/IPRC_Seized_2016_kat.jpg\nhttp://kickass.to/the-adventures-of-tom-sawyer-t2068537.html\t\nhttp://bludv.tv/iprc_seized_banner.png\nhttp://z-lib.org/iprc_seized_banner.png\nIPRC_Seized_2016_kat.jpg\n... just banners? Moved and continue? Okay.\nListed below also listed in seized domain. Domains,URL's and Botnetwork Hosts still seem to exist.\nhttp://alohatube.xyz/search/tsara-brashears\nalohatube.xyz\nhttps://alohatube.xyz/search/tsara-brashears\nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/\nhttp://45.159.189.105/bot/regex\t\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbia\t\nnr-data.net",
      "modified": "2023-12-20T17:01:34.161000",
      "created": "2023-11-20T17:42:40.771000",
      "tags": [
        "safe site",
        "million",
        "cisco umbrella",
        "alexa top",
        "site",
        "tag count",
        "tld count",
        "jul jan",
        "team alexa",
        "count blacklist",
        "maltiverse",
        "redirme",
        "cronup threat",
        "intel malware",
        "malicious site",
        "malware",
        "no data",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "united",
        "cyber threat",
        "engineering",
        "team",
        "malware site",
        "covid19",
        "phishing site",
        "phishing",
        "phishtank",
        "bank",
        "zbot",
        "malicious",
        "download",
        "suppobox",
        "zeus",
        "nymaim",
        "matsnu",
        "artemis",
        "virut",
        "panama",
        "smsspy",
        "cobalt strike",
        "emotet",
        "bradesco",
        "stealer",
        "facebook",
        "service",
        "simda",
        "runescape",
        "cutwail",
        "unruy",
        "bandoo",
        "tinba",
        "pykspa",
        "domaiq",
        "ave maria",
        "citadel",
        "pony",
        "keitaro",
        "ponmocup",
        "ransomware",
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "sha256",
        "sha1",
        "ascii text",
        "date",
        "unknown",
        "body",
        "error",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "malicious url",
        "union",
        "unsafe",
        "node tcp",
        "traffic",
        "tor known",
        "tor relayrouter",
        "spammer",
        "threats et",
        "ssl certificate",
        "contacted",
        "whois record",
        "whois whois",
        "historical ssl",
        "apple ios",
        "resolutions",
        "bundled",
        "referrer",
        "collections",
        "android",
        "banker",
        "keylogger",
        "generic malware",
        "generic",
        "blacklist http",
        "ac32a",
        "heur",
        "alexa",
        "xtrat",
        "iframe",
        "installcore",
        "win64",
        "crack",
        "xrat",
        "nircmd",
        "swrort",
        "agent",
        "filetour",
        "cleaner",
        "patcher",
        "adload",
        "wacatac",
        "riskware",
        "acint",
        "conduit",
        "fakealert",
        "opencandy",
        "xtreme",
        "downldr",
        "outbreak",
        "iobit",
        "rostpay",
        "dropper",
        "mediaget",
        "installpack",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "floxif",
        "presenoker",
        "fusioncore",
        "exploit",
        "filerepmetagen",
        "download json",
        "hostname",
        "hostnames",
        "mail spammer",
        "anonymizer",
        "firehol proxy",
        "asyncrat",
        "genkryptik",
        "fuery",
        "webtoolbar",
        "trojanspy",
        "dropped",
        "execution",
        "contacted urls",
        "http spammer",
        "host",
        "ip address",
        "site top",
        "site safe",
        "blacklist https",
        "tsara brashears",
        "kgs0",
        "kls0",
        "critical risk",
        "attack",
        "hacktool",
        "installer"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Latvia",
        "Poland",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 46,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1117,
        "FileHash-SHA1": 664,
        "FileHash-SHA256": 3426,
        "domain": 977,
        "hostname": 2269,
        "URL": 5554,
        "CVE": 23,
        "URI": 8,
        "Mutex": 1
      },
      "indicator_count": 14039,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "851 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656a9c2eeebaf7b69d0e12ba",
      "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
      "description": "",
      "modified": "2023-12-20T17:01:34.161000",
      "created": "2023-12-02T02:53:34.585000",
      "tags": [
        "safe site",
        "million",
        "cisco umbrella",
        "alexa top",
        "site",
        "tag count",
        "tld count",
        "jul jan",
        "team alexa",
        "count blacklist",
        "maltiverse",
        "redirme",
        "cronup threat",
        "intel malware",
        "malicious site",
        "malware",
        "no data",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "united",
        "cyber threat",
        "engineering",
        "team",
        "malware site",
        "covid19",
        "phishing site",
        "phishing",
        "phishtank",
        "bank",
        "zbot",
        "malicious",
        "download",
        "suppobox",
        "zeus",
        "nymaim",
        "matsnu",
        "artemis",
        "virut",
        "panama",
        "smsspy",
        "cobalt strike",
        "emotet",
        "bradesco",
        "stealer",
        "facebook",
        "service",
        "simda",
        "runescape",
        "cutwail",
        "unruy",
        "bandoo",
        "tinba",
        "pykspa",
        "domaiq",
        "ave maria",
        "citadel",
        "pony",
        "keitaro",
        "ponmocup",
        "ransomware",
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "sha256",
        "sha1",
        "ascii text",
        "date",
        "unknown",
        "body",
        "error",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "malicious url",
        "union",
        "unsafe",
        "node tcp",
        "traffic",
        "tor known",
        "tor relayrouter",
        "spammer",
        "threats et",
        "ssl certificate",
        "contacted",
        "whois record",
        "whois whois",
        "historical ssl",
        "apple ios",
        "resolutions",
        "bundled",
        "referrer",
        "collections",
        "android",
        "banker",
        "keylogger",
        "generic malware",
        "generic",
        "blacklist http",
        "ac32a",
        "heur",
        "alexa",
        "xtrat",
        "iframe",
        "installcore",
        "win64",
        "crack",
        "xrat",
        "nircmd",
        "swrort",
        "agent",
        "filetour",
        "cleaner",
        "patcher",
        "adload",
        "wacatac",
        "riskware",
        "acint",
        "conduit",
        "fakealert",
        "opencandy",
        "xtreme",
        "downldr",
        "outbreak",
        "iobit",
        "rostpay",
        "dropper",
        "mediaget",
        "installpack",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "floxif",
        "presenoker",
        "fusioncore",
        "exploit",
        "filerepmetagen",
        "download json",
        "hostname",
        "hostnames",
        "mail spammer",
        "anonymizer",
        "firehol proxy",
        "asyncrat",
        "genkryptik",
        "fuery",
        "webtoolbar",
        "trojanspy",
        "dropped",
        "execution",
        "contacted urls",
        "http spammer",
        "host",
        "ip address",
        "site top",
        "site safe",
        "blacklist https",
        "tsara brashears",
        "kgs0",
        "kls0",
        "critical risk",
        "attack",
        "hacktool",
        "installer"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Latvia",
        "Poland",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655b9a90e44a70d0fbbde981",
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1117,
        "FileHash-SHA1": 664,
        "FileHash-SHA256": 3426,
        "domain": 977,
        "hostname": 2269,
        "URL": 5554,
        "CVE": 23,
        "URI": 8,
        "Mutex": 1
      },
      "indicator_count": 14039,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "851 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mail02.shareregister.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mail02.shareregister.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638685.9819782
}