{
  "type": "URL",
  "indicator": "https://mails-apple.com/719",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mails-apple.com/719",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3661727041,
      "indicator": "https://mails-apple.com/719",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 50,
      "pulses": [
        {
          "id": "69d68fffbf012630d57033b6",
          "name": "Sabey SWIPPER - Pornhub\u00bbX.Com migration to Twitter | Sabey\u2019s Daddy Data Center ",
          "description": "",
          "modified": "2026-04-08T17:27:27.851000",
          "created": "2026-04-08T17:27:27.851000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69bea426487bffa5384c6f38",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "12 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bea426487bffa5384c6f38",
          "name": " Brian Sabey illegally deleting IoC\u2019s | SWIPPER - Pornhub\u00bbX.Com migration to Twitter Sabey Erasing",
          "description": "",
          "modified": "2026-03-21T13:59:02.016000",
          "created": "2026-03-21T13:59:02.016000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "30 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a9e7c572b8411d126215a6",
          "name": "@scoreblue callback clone",
          "description": "",
          "modified": "2026-03-06T05:11:18.020000",
          "created": "2026-03-05T20:29:57.169000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a052c4160dbd76054f8a",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3267,
            "domain": 1459,
            "hostname": 1268,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9172,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 50,
          "modified_text": "45 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68888ed9c3a537ac4491eba7",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration [scoreblue]",
          "description": "",
          "modified": "2025-07-29T09:05:29.205000",
          "created": "2025-07-29T09:05:29.205000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "265 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d4916fa7338286448118a1",
          "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com migration to Twitter ",
          "description": "",
          "modified": "2024-10-19T18:02:34.237000",
          "created": "2024-09-01T16:08:15.260000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ccbd92f716bb0ca0fda93d",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 935,
            "URL": 5882,
            "domain": 571,
            "hostname": 1418,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 9054,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "548 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6523344e4adc85389899504c",
          "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
          "description": "",
          "modified": "2024-10-13T03:00:28.081000",
          "created": "2023-10-08T22:59:26.040000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b48d699080b4bfd334c5",
          "export_count": 74,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7761,
            "CVE": 6,
            "FileHash-MD5": 285,
            "FileHash-SHA1": 165,
            "FileHash-SHA256": 5059,
            "domain": 987,
            "hostname": 2399
          },
          "indicator_count": 16662,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "554 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "670268310c19cecfd0fdce4b",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey - Pornhub Campaigns X.Com",
          "description": "",
          "modified": "2024-10-06T10:36:33.718000",
          "created": "2024-10-06T10:36:33.718000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "561 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66eb08c239be3721ab6c9050",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration to Twitter",
          "description": "",
          "modified": "2024-10-06T10:30:32.632000",
          "created": "2024-09-18T17:07:14.432000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66d4916fa7338286448118a1",
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "561 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652a901fe2dbea9024b3d614",
          "name": "Black Tech",
          "description": "Found in a malicious Apple iTunes link. Lists several independent artists. Music \"producer\" is potentially highly dependent on use of AI generated instrumentation and conception.  Hacking seems to target a single target and associates.",
          "modified": "2024-09-24T00:01:38.502000",
          "created": "2023-10-14T12:57:03.183000",
          "tags": [
            "referrer",
            "historical ssl",
            "ssl certificate",
            "whois record",
            "whois ssl",
            "whois",
            "historical",
            "siblings parent",
            "network",
            "number",
            "label shanghai",
            "blue cloud",
            "ltd regional",
            "apnic country",
            "cn continent",
            "algorithm",
            "data",
            "v3 serial",
            "cus cndigicert",
            "basic rsa",
            "cn ca",
            "g2 odigicert",
            "inc validity",
            "oshanghai blue",
            "road",
            "beijing country",
            "beijing",
            "please",
            "apnic person",
            "cn phone",
            "whois lookup",
            "bluecloud descr",
            "shanghai blue",
            "ltd descr",
            "cnnic",
            "whois lookups",
            "updated date",
            "apnic netname",
            "beijing abusec",
            "abuse cnniccn",
            "liu registrant",
            "country",
            "dns replication",
            "date",
            "domain",
            "first",
            "blacklist https",
            "heur",
            "html",
            "malware",
            "alexa top",
            "site",
            "filerepmetagen",
            "suspected",
            "adware",
            "cisco umbrella",
            "malware site",
            "win64",
            "opencandy",
            "cleaner",
            "artemis",
            "iframe",
            "agent",
            "unsafe",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "exploit",
            "presenoker",
            "filetour",
            "conduit",
            "wacatac",
            "softcnapp",
            "xtrat",
            "cve201711882",
            "memscan",
            "phishing",
            "maltiverse",
            "zbot",
            "webtoolbar",
            "trojanspy",
            "million",
            "united",
            "phishing site",
            "malicious site",
            "proxy",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "safe site",
            "team",
            "fusioncore",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "alexa",
            "adposhel",
            "installpack",
            "xrat",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "gamehack",
            "verdict",
            "falcon sandbox",
            "pattern match",
            "show",
            "file",
            "indicator",
            "ascii text",
            "appdata",
            "mitre att",
            "et tor",
            "known tor",
            "severity",
            "hybrid",
            "general",
            "misc attack",
            "beginstring",
            "script",
            "relayrouter",
            "exit",
            "node traffic",
            "null",
            "error",
            "unknown",
            "span",
            "body",
            "refresh",
            "class",
            "critical",
            "tools",
            "look",
            "verify",
            "restart",
            "click",
            "strings",
            "meta",
            "anonymizer",
            "team proxy",
            "host",
            "control server",
            "meterpreter",
            "dnspionage",
            "filerepmalware",
            "fakealert",
            "pony",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "patcher",
            "adload",
            "webcompanion",
            "seraph",
            "downloader",
            "generic",
            "dapato",
            "redline stealer",
            "beach research",
            "blacklist http",
            "generic malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "bundled",
            "dropped",
            "contacted",
            "most malicious",
            "server",
            "parent parent"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Behav",
              "display_name": "Behav",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 50,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2449,
            "FileHash-SHA1": 217,
            "FileHash-SHA256": 3441,
            "URL": 2044,
            "domain": 258,
            "hostname": 1100,
            "CIDR": 1,
            "email": 4,
            "CVE": 37
          },
          "indicator_count": 9551,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "573 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ccbd92f716bb0ca0fda93d",
          "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com - allows redirection for member abuse of Crime Victim",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-26T17:38:26.472000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ca36c85ccdb4c97c164228",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66cc6dd98fdbf12d67404091",
          "name": "2",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-26T11:58:17.321000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66c5db8e996dcef20be8a618",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Krishivpatel",
            "id": "292085",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 26,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ca36c85ccdb4c97c164228",
          "name": ".com - Porn Smear | Brian Sabey | Sabey Data Centers & Swipp9",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-24T19:38:48.399000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66c66b55663b96406b28c28c",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c66b55663b96406b28c28c",
          "name": "x.com - Porn Smear | Brian Sabey | Sabey Data Centers & Swipp-a-dee-doo-dah ",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-21T22:33:57.501000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66c5db8e996dcef20be8a618",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c5db8e996dcef20be8a618",
          "name": "x.com - Ridiculous Porn Smear | Brian Sabey | Sabey Data Centers | Thebrotherssabey | Hallrender.com",
          "description": "It's a crazy I have to post this way. OTX has a stealer in it that I haven't found. It is attacking accounts and removing incriminating posts. Brian Sabey has been hired to destroy reputations, privacy, peace and everything he is doing is illegal.  Most PI/s and law firms have this 'attorney resource' in their arsenal. In the state of Colorado; you don't even need a license to be a private investigator. The target I've been researching for has been approached by all kinds of PI's. Addicts, some telling what they were doing, defunct veterans. I'm not making fun of veterans, it should be considered that besides seizures, veterans with untreatable PTSD are being used to push cannabis, hallucinogenics, ketamine for treatment. Imagine having one of those guys approach you for drugs then remember they are stalking/watching your every move. This isn't an investigation. This is abuse",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-21T12:20:30.851000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c5db8bbc7d57514ddcc757",
          "name": "x.com - Ridiculous Porn Smear | Brian Sabey | Sabey Data Centers | Thebrotherssabey | Hallrender.com",
          "description": "It's a crazy I have to post this way. OTX has a stealer in it that I haven't found. It is attacking accounts and removing incriminating posts. Brian Sabey has been hired to destroy reputations, privacy, peace and everything he is doing is illegal.  Most PI/s and law firms have this 'attorney resource' in their arsenal. In the state of Colorado; you don't even need a license to be a private investigator. The target I've been researching for has been approached by all kinds of PI's. Addicts, some telling what they were doing, defunct veterans. I'm not making fun of veterans, it should be considered that besides seizures, veterans with untreatable PTSD are being used to push cannabis, hallucinogenics, ketamine for treatment. Imagine having one of those guys approach you for drugs then remember they are stalking/watching your every move. This isn't an investigation. This is abuse",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-21T12:20:27.469000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b9716ef65566497546a7b1",
          "name": "Callback Phishing Campaign | Pegasus | https://safebae.org/",
          "description": "",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T22:00:14.725000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a05a0b9ebf8d916f0a6d",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8a052c4160dbd76054f8a",
          "name": "Callback Phishing Campaign | Pegasus |  Callback Phishing | https://safebae.org/",
          "description": "Multiple ransomware groups have adopted the  BazarCall callback phishing technique a sophisticated scam; to gain initial access to victims' networks\nCallback phishing is a  relying on a multi-stage process, exploiting trust to manipulate victims into divulging sensitive information or. At its core, callback phishing is a sophisticated social engineering tactic that triggers an emotional reaction from a victim and compels them to engage.\n\nStrange alleged tribute website appears to target Tsara Brashears. The alleged SA victims name is Catherine 'Daisy' Coleman name isn't part infrastructure. Malicious",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T07:08:02.918000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8a056f2c1f16d391175b0",
          "name": "Callback Phishing Campaign | Pegasus |  Callback Phishing | https://safebae.org/",
          "description": "Multiple ransomware groups have adopted the  BazarCall callback phishing technique a sophisticated scam; to gain initial access to victims' networks\nCallback phishing is a  relying on a multi-stage process, exploiting trust to manipulate victims into divulging sensitive information or. At its core, callback phishing is a sophisticated social engineering tactic that triggers an emotional reaction from a victim and compels them to engage.\n\nStrange alleged tribute website appears to target Tsara Brashears. The alleged SA victims name is Catherine 'Daisy' Coleman name isn't part infrastructure. Malicious",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T07:08:06.711000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8a05a0b9ebf8d916f0a6d",
          "name": "Callback Phishing Campaign | Pegasus |  Callback Phishing | https://safebae.org/",
          "description": "Multiple ransomware groups have adopted the  BazarCall callback phishing technique a sophisticated scam; to gain initial access to victims' networks\nCallback phishing is a  relying on a multi-stage process, exploiting trust to manipulate victims into divulging sensitive information or. At its core, callback phishing is a sophisticated social engineering tactic that triggers an emotional reaction from a victim and compels them to engage.\n\nStrange alleged tribute website appears to target Tsara Brashears. The alleged SA victims name is Catherine 'Daisy' Coleman name isn't part infrastructure. Malicious",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T07:08:10.072000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be8c8b8997508722c642ee",
          "name": "Phishing Campaign | Pegasus ",
          "description": "",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-02-03T18:57:15.475000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a05a0b9ebf8d916f0a6d",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c970b55f5040aee8c91a55",
          "name": "Callback Phishing Campaign | Pegasus",
          "description": "",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-02-12T01:13:25.034000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a05a0b9ebf8d916f0a6d",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65944b9812ea52ab41c0259d",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2024-01-02T17:44:56.709000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "812 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659127f3265ec6306b607faa",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-31T08:36:03.380000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "812 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658f967a4fc7ebe8021b9382",
          "name": "Mirai Apple Attack +",
          "description": "This is hard to make sense of. All calls, clicks on a DGA Domain masquerading as desired service, lands you on the radar of a faux service where in turn bad actors attack everything. Target, remotely hack, follow, smear your life, same victim auto populates 79%, no hunt for assaulter.\n I'm assuming to see it one must 1st be in a Botnet. We keep seeing the same targets but no preparator. \nShe said \"Life was busy, life was good; full of health and hope. Then one sunny October day... I'm still grateful but what happened my body, thoughts and the world around me? Where's God? Am I a criminally responsible for getting attacked?\"",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-30T04:03:06.598000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "812 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65676fdedd4bf87319fcd14a",
          "name": "RATel  \u2022 Apple iOS \u2022 NEWORDER.doc \u2022 http://ocsp2.apple.com/",
          "description": "",
          "modified": "2023-12-29T16:03:00.220000",
          "created": "2023-11-29T17:07:42.477000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "apple",
            "historical ssl",
            "referrer",
            "resolutions",
            "highly targeted",
            "execution",
            "password",
            "ratel",
            "core",
            "hacktool",
            "attack",
            "life",
            "android",
            "project",
            "chaos",
            "ransomexx",
            "quasar",
            "name verdict",
            "no data",
            "tag count",
            "threat report",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "pattern match",
            "script",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "beginstring",
            "mitre att",
            "null",
            "date",
            "unknown",
            "error",
            "span",
            "class",
            "generator",
            "critical",
            "body",
            "meta",
            "hybrid",
            "general",
            "click",
            "strings",
            "refresh",
            "tools",
            "ip summary",
            "url summary",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "team",
            "microsoft",
            "malicious url",
            "phishing",
            "union",
            "bank",
            "traffic",
            "tor known",
            "tor relayrouter",
            "node tcp",
            "spammer",
            "anonymizer",
            "united",
            "firehol gozi",
            "cname",
            "aaaa",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnapple",
            "public server",
            "ecc ca",
            "g1 oapple",
            "validity",
            "public key",
            "info",
            "domain status",
            "server",
            "redacted for",
            "privacy tech",
            "privacy admin",
            "email",
            "registrar abuse",
            "country",
            "postal code",
            "code",
            "csc corporate",
            "domains",
            "registrar url",
            "registry domain",
            "contact phone",
            "registrar whois",
            "security",
            "dns replication",
            "servers",
            "passive dns",
            "urls",
            "creation date",
            "rsa cn",
            "ca g2",
            "search",
            "record value",
            "object",
            "certificate",
            "orgtechhandle",
            "apple computer",
            "orgtechref",
            "rauschenberg",
            "rtechhandle",
            "rtechref",
            "network",
            "registry arin",
            "country us",
            "domain",
            "lookups",
            "city",
            "orgid",
            "stevens creek",
            "city center",
            "dropped",
            "pe resource",
            "collections",
            "contacted urls",
            "stealer",
            "nanocore",
            "malicious",
            "installer",
            "neworder.doc",
            "et",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "setcookie geous",
            "cookie",
            "malware site",
            "malicious site",
            "genericm",
            "phishing site",
            "malware",
            "lazarus",
            "tulach",
            "tsara brashears",
            "targeting",
            "malvertizing",
            "ios",
            "icloud compromise",
            "apple support compromise",
            "apple app store compromise",
            "t-mobile",
            "metroby-tmo",
            "metro",
            "dgs",
            "qwest",
            "zombie devices",
            "python infostealer",
            "soc",
            "red",
            "galaxy watch",
            "gear s",
            "watch",
            "samsung galaxy",
            "app store",
            "gear s2",
            "gear sport",
            "gear s3",
            "active",
            "active2",
            "galaxy",
            "blacklist https",
            "tld count",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "hostname",
            "pulse submit",
            "url analysis",
            "files",
            "verdict",
            "samsug",
            "galaxy watch",
            "registrar",
            "showing",
            "as43350 nforce",
            "united kingdom",
            "alexa top",
            "alexa"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/c52df9e010faa90f567fb29345b551506398b450a3c68c64e40f337b7b054bca",
            "ocsp2.apple.com | IP 17.253.29.199",
            "5b574f4989724909s@anonymised.email      | contact information seems evasive and illegitimate",
            "CA Issuers - http://certs.apple.com/apsecc12g1.der OCSP - http://ocsp.apple.com/ocsp03-apsecc12g101 X509v3 Basic Constraints: CA:FALSE",
            "37.48.65.150           |  command and control",
            "45.33.18.44             |  command and control",
            "45.33.2.79               |  command and control",
            "45.33.20.235           |  command and control",
            "45.33.23.183            |  command and control",
            "45.33.30.197            |  command and control",
            "45.56.79.23             |  command and control",
            "45.79.19.196            |  command and control",
            "172.93.103.100        |  command and control",
            "198.58.118.167        |  command and control",
            "185.107.56.200       |  command and control",
            "45.33.18.44             |  command and control",
            "45.33.2.79               |  command and control",
            "45.79.19.196            |  command and control",
            "5.79.79.211              |  command and control",
            "72.14.178.174           |  command and control",
            "72.14.178.174           |  command and control",
            "72.14.185.43            |  command and control",
            "96.126.123.244       |  command and control",
            "20.99.186.246        |  command and contro",
            "103.246.145.111      | scanning host",
            "https://tulach.cc/  | phishing",
            "tulach.cc.               | Malicious compromises \u2022 Critical",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  | Apple password cracker \u2022 Cyber attack targeting SA victim",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/            | phishing attack \u2022 retaliation after alleged SA by Doctor of Physical Therapy",
            "https://twitter.com/PORNO_SEXYBABES.                | Botnetwork T-Mobile attack",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel | Dangerous Malware",
            "message.htm.com   | malware ransomware spreader",
            "ussjc9-edge-bx-008.ts.apple.com   | malware",
            "nr-data.net | Apple Private Data Collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US?  | \"Zero Click\" remote attack \u2022 enters through Apple apps ( apple tv, iTunes,etc)",
            "apple.com      | malicious \u2022 geo tracking",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635  | Blog",
            "https://apps.apple.com/us/app/samsung-galaxy-watch-gear-s/id1117310635    | App argument",
            "drip.colorado.edu = colorado.edu @ University of Colorado Boulder"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "NEWORDER.doc",
              "display_name": "NEWORDER.doc",
              "target": null
            },
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Nimnul",
              "display_name": "Nimnul",
              "target": null
            },
            {
              "id": "Botnet Army",
              "display_name": "Botnet Army",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            }
          ],
          "industries": [
            "Telecommunications",
            "Public"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 39,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4559,
            "FileHash-MD5": 187,
            "FileHash-SHA1": 161,
            "FileHash-SHA256": 2628,
            "domain": 744,
            "hostname": 1598,
            "email": 11,
            "CVE": 1,
            "CIDR": 2
          },
          "indicator_count": 9891,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "843 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a986b2f9afc18556b1181",
          "name": "RATel \u2022 Apple iOS \u2022 NEWORDER.doc \u2022 http://ocsp2.apple.com/",
          "description": "",
          "modified": "2023-12-29T16:03:00.220000",
          "created": "2023-12-02T02:37:31.842000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "apple",
            "historical ssl",
            "referrer",
            "resolutions",
            "highly targeted",
            "execution",
            "password",
            "ratel",
            "core",
            "hacktool",
            "attack",
            "life",
            "android",
            "project",
            "chaos",
            "ransomexx",
            "quasar",
            "name verdict",
            "no data",
            "tag count",
            "threat report",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "pattern match",
            "script",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "beginstring",
            "mitre att",
            "null",
            "date",
            "unknown",
            "error",
            "span",
            "class",
            "generator",
            "critical",
            "body",
            "meta",
            "hybrid",
            "general",
            "click",
            "strings",
            "refresh",
            "tools",
            "ip summary",
            "url summary",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "team",
            "microsoft",
            "malicious url",
            "phishing",
            "union",
            "bank",
            "traffic",
            "tor known",
            "tor relayrouter",
            "node tcp",
            "spammer",
            "anonymizer",
            "united",
            "firehol gozi",
            "cname",
            "aaaa",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnapple",
            "public server",
            "ecc ca",
            "g1 oapple",
            "validity",
            "public key",
            "info",
            "domain status",
            "server",
            "redacted for",
            "privacy tech",
            "privacy admin",
            "email",
            "registrar abuse",
            "country",
            "postal code",
            "code",
            "csc corporate",
            "domains",
            "registrar url",
            "registry domain",
            "contact phone",
            "registrar whois",
            "security",
            "dns replication",
            "servers",
            "passive dns",
            "urls",
            "creation date",
            "rsa cn",
            "ca g2",
            "search",
            "record value",
            "object",
            "certificate",
            "orgtechhandle",
            "apple computer",
            "orgtechref",
            "rauschenberg",
            "rtechhandle",
            "rtechref",
            "network",
            "registry arin",
            "country us",
            "domain",
            "lookups",
            "city",
            "orgid",
            "stevens creek",
            "city center",
            "dropped",
            "pe resource",
            "collections",
            "contacted urls",
            "stealer",
            "nanocore",
            "malicious",
            "installer",
            "neworder.doc",
            "et",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "setcookie geous",
            "cookie",
            "malware site",
            "malicious site",
            "genericm",
            "phishing site",
            "malware",
            "lazarus",
            "tulach",
            "tsara brashears",
            "targeting",
            "malvertizing",
            "ios",
            "icloud compromise",
            "apple support compromise",
            "apple app store compromise",
            "t-mobile",
            "metroby-tmo",
            "metro",
            "dgs",
            "qwest",
            "zombie devices",
            "python infostealer",
            "soc",
            "red",
            "galaxy watch",
            "gear s",
            "watch",
            "samsung galaxy",
            "app store",
            "gear s2",
            "gear sport",
            "gear s3",
            "active",
            "active2",
            "galaxy",
            "blacklist https",
            "tld count",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "hostname",
            "pulse submit",
            "url analysis",
            "files",
            "verdict",
            "samsug",
            "galaxy watch",
            "registrar",
            "showing",
            "as43350 nforce",
            "united kingdom",
            "alexa top",
            "alexa"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/c52df9e010faa90f567fb29345b551506398b450a3c68c64e40f337b7b054bca",
            "ocsp2.apple.com | IP 17.253.29.199",
            "5b574f4989724909s@anonymised.email      | contact information seems evasive and illegitimate",
            "CA Issuers - http://certs.apple.com/apsecc12g1.der OCSP - http://ocsp.apple.com/ocsp03-apsecc12g101 X509v3 Basic Constraints: CA:FALSE",
            "37.48.65.150           |  command and control",
            "45.33.18.44             |  command and control",
            "45.33.2.79               |  command and control",
            "45.33.20.235           |  command and control",
            "45.33.23.183            |  command and control",
            "45.33.30.197            |  command and control",
            "45.56.79.23             |  command and control",
            "45.79.19.196            |  command and control",
            "172.93.103.100        |  command and control",
            "198.58.118.167        |  command and control",
            "185.107.56.200       |  command and control",
            "45.33.18.44             |  command and control",
            "45.33.2.79               |  command and control",
            "45.79.19.196            |  command and control",
            "5.79.79.211              |  command and control",
            "72.14.178.174           |  command and control",
            "72.14.178.174           |  command and control",
            "72.14.185.43            |  command and control",
            "96.126.123.244       |  command and control",
            "20.99.186.246        |  command and contro",
            "103.246.145.111      | scanning host",
            "https://tulach.cc/  | phishing",
            "tulach.cc.               | Malicious compromises \u2022 Critical",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  | Apple password cracker \u2022 Cyber attack targeting SA victim",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/            | phishing attack \u2022 retaliation after alleged SA by Doctor of Physical Therapy",
            "https://twitter.com/PORNO_SEXYBABES.                | Botnetwork T-Mobile attack",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel | Dangerous Malware",
            "message.htm.com   | malware ransomware spreader",
            "ussjc9-edge-bx-008.ts.apple.com   | malware",
            "nr-data.net | Apple Private Data Collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US?  | \"Zero Click\" remote attack \u2022 enters through Apple apps ( apple tv, iTunes,etc)",
            "apple.com      | malicious \u2022 geo tracking",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635  | Blog",
            "https://apps.apple.com/us/app/samsung-galaxy-watch-gear-s/id1117310635    | App argument",
            "drip.colorado.edu = colorado.edu @ University of Colorado Boulder"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "NEWORDER.doc",
              "display_name": "NEWORDER.doc",
              "target": null
            },
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Nimnul",
              "display_name": "Nimnul",
              "target": null
            },
            {
              "id": "Botnet Army",
              "display_name": "Botnet Army",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            }
          ],
          "industries": [
            "Telecommunications",
            "Public"
          ],
          "TLP": "white",
          "cloned_from": "65676fdedd4bf87319fcd14a",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4559,
            "FileHash-MD5": 187,
            "FileHash-SHA1": 161,
            "FileHash-SHA256": 2628,
            "domain": 744,
            "hostname": 1598,
            "email": 11,
            "CVE": 1,
            "CIDR": 2
          },
          "indicator_count": 9891,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "843 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6564fa9a3d90d1cd14928b16",
          "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading",
          "description": "I was contacted on this forum re: University of Alberta issue. Based on research  www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted  'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.",
          "modified": "2023-12-27T19:03:02.665000",
          "created": "2023-11-27T20:22:50.050000",
          "tags": [
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json url",
            "urls",
            "detection list",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "malicious site",
            "phishing site",
            "malicious url",
            "phishing",
            "riskware",
            "presenoker",
            "artemis",
            "agent",
            "unsafe",
            "opencandy",
            "ursnif",
            "wacatac",
            "team",
            "facebook",
            "runescape",
            "service",
            "downldr",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "installcore",
            "fareit",
            "secrisk",
            "exploit",
            "mimikatz",
            "sorano",
            "emotet",
            "genkryptik",
            "fuery",
            "dbatloader",
            "qakbot",
            "alexa",
            "malicious",
            "union",
            "lumma stealer",
            "fusioncore",
            "cleaner",
            "azorult",
            "bank",
            "blacknet rat",
            "stealer",
            "iframe",
            "trojanspy",
            "analysis",
            "united",
            "firehol",
            "proxy",
            "mail spammer",
            "downloader",
            "malware site",
            "meterpreter",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "unruy",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "generic",
            "dnspionage",
            "expirestue",
            "path",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "alberta",
            "university",
            "edmonton",
            "html info",
            "alberta meta",
            "tags",
            "trackers google",
            "tag manager",
            "gtmkr32",
            "blacklist",
            "low risk",
            "apache",
            "domain",
            "malware found",
            "unknown",
            "minimal low",
            "security risk",
            "medium high",
            "critical",
            "protect",
            "college",
            "mtis",
            "faculties",
            "research",
            "health",
            "a about",
            "news",
            "events",
            "sport",
            "life",
            "find",
            "story",
            "tools",
            "getprocaddress",
            "indicator",
            "prefetch8",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "pattern match",
            "file",
            "date",
            "factory",
            "hybrid",
            "general",
            "cookie",
            "click",
            "strings",
            "djin",
            "no data",
            "tag count",
            "sample",
            "samples",
            "netsky",
            "cobalt strike",
            "xrat",
            "fakealert",
            "raccoon",
            "redline stealer",
            "metastealer",
            "icedid",
            "quasar rat",
            "acint",
            "anonymizer",
            "blockchain",
            "social engineering",
            "read c",
            "search",
            "show",
            "medium",
            "entries",
            "whitelisted",
            "memcommit",
            "delete",
            "yara detections",
            "next",
            "dock",
            "write",
            "execution",
            "copy",
            "south carolina",
            "federal credit",
            "team proxy",
            "static engine",
            "covid19",
            "redirector",
            "suspic",
            "tue mar",
            "zbot",
            "size68b type",
            "count blacklist",
            "tag tag",
            "rejected sample",
            "icon",
            "analyzed",
            "hwp support",
            "falcon sandbox",
            "multi scan",
            "update",
            "view details",
            "upgrade",
            "blacklist https",
            "keyloggers"
          ],
          "references": [
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
            "uchealth.com",
            "http://michaela.young@uchealth.com",
            "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
            "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
            "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "MimiKatz",
              "display_name": "MimiKatz",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Network RAT",
              "display_name": "Network RAT",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Raccoon",
              "display_name": "Raccoon",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "Meterpreter",
              "display_name": "Meterpreter",
              "target": null
            },
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "TrojanX",
              "display_name": "TrojanX",
              "target": null
            },
            {
              "id": "BlackNET RAT",
              "display_name": "BlackNET RAT",
              "target": null
            },
            {
              "id": "Brontok",
              "display_name": "Brontok",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1588.004",
              "name": "Digital Certificates",
              "display_name": "T1588.004 - Digital Certificates"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            },
            {
              "id": "T1126",
              "name": "Network Share Connection Removal",
              "display_name": "T1126 - Network Share Connection Removal"
            },
            {
              "id": "T1136",
              "name": "Create Account",
              "display_name": "T1136 - Create Account"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1134.004",
              "name": "Parent PID Spoofing",
              "display_name": "T1134.004 - Parent PID Spoofing"
            }
          ],
          "industries": [
            "Education",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 320,
            "FileHash-SHA1": 172,
            "FileHash-SHA256": 4302,
            "URL": 8243,
            "CIDR": 1,
            "domain": 1742,
            "hostname": 2270,
            "CVE": 18,
            "SSLCertFingerprint": 3,
            "email": 4
          },
          "indicator_count": 17075,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "845 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a9123acb8410d1158f8a",
          "name": "DNSpionage",
          "description": "",
          "modified": "2023-12-06T17:02:10.861000",
          "created": "2023-12-06T17:02:10.861000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 27,
            "FileHash-SHA256": 3307,
            "hostname": 1083,
            "FileHash-MD5": 2420,
            "FileHash-SHA1": 189,
            "domain": 255,
            "URL": 1933,
            "CIDR": 1,
            "email": 4
          },
          "indicator_count": 9219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a90bc683765a535061dc",
          "name": "27 CVE Talley | GameHack l Beach Research",
          "description": "",
          "modified": "2023-12-06T17:02:03.119000",
          "created": "2023-12-06T17:02:03.119000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 27,
            "FileHash-SHA256": 3307,
            "hostname": 1083,
            "FileHash-MD5": 2420,
            "FileHash-SHA1": 189,
            "domain": 255,
            "URL": 1933,
            "CIDR": 1,
            "email": 4
          },
          "indicator_count": 9219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a903fc0836f148fa45c9",
          "name": "Oshanghai Blue",
          "description": "",
          "modified": "2023-12-06T17:01:55.465000",
          "created": "2023-12-06T17:01:55.465000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 27,
            "FileHash-SHA256": 3307,
            "hostname": 1083,
            "FileHash-MD5": 2420,
            "FileHash-SHA1": 189,
            "domain": 255,
            "URL": 1933,
            "CIDR": 1,
            "email": 4
          },
          "indicator_count": 9219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8fb83452e1699674c37",
          "name": "Black Tech",
          "description": "",
          "modified": "2023-12-06T17:01:47.488000",
          "created": "2023-12-06T17:01:47.488000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 27,
            "FileHash-SHA256": 3307,
            "hostname": 1083,
            "FileHash-MD5": 2420,
            "FileHash-SHA1": 189,
            "domain": 255,
            "URL": 1933,
            "CIDR": 1,
            "email": 4
          },
          "indicator_count": 9219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8d167202b93ee502ff8",
          "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
          "description": "",
          "modified": "2023-12-06T17:01:05.291000",
          "created": "2023-12-06T17:01:05.291000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 12,
            "URL": 3839,
            "hostname": 1331,
            "FileHash-SHA256": 2976,
            "domain": 757,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 80
          },
          "indicator_count": 9245,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a835fc0836f148fa45c8",
          "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
          "description": "",
          "modified": "2023-12-06T16:58:29.243000",
          "created": "2023-12-06T16:58:29.243000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a521974bdb5d6dbda092",
          "name": "",
          "description": "",
          "modified": "2023-12-06T16:45:21.776000",
          "created": "2023-12-06T16:45:21.776000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a5109ecc3c75c949f950",
          "name": "Unsupported IE 404 account running BotNet Command & Control Server | B/L",
          "description": "",
          "modified": "2023-12-06T16:45:04.296000",
          "created": "2023-12-06T16:45:04.296000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4f322399eb1db2a07b2",
          "name": "Hijacked Pinterest Account Spreader, BotNet Control Server | Unsupported IE",
          "description": "",
          "modified": "2023-12-06T16:44:35.786000",
          "created": "2023-12-06T16:44:35.786000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4e083c4acd789ea7e58",
          "name": "Blacklisted",
          "description": "",
          "modified": "2023-12-06T16:44:16.060000",
          "created": "2023-12-06T16:44:16.060000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2258,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15663,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4d5c14495fcf65ee8a5",
          "name": "Netsky",
          "description": "",
          "modified": "2023-12-06T16:44:05.631000",
          "created": "2023-12-06T16:44:05.631000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4cb97598bac143dc90b",
          "name": "Critical: Pinterest Cyber Espionage",
          "description": "",
          "modified": "2023-12-06T16:43:55.639000",
          "created": "2023-12-06T16:43:55.639000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657099d8a0c84c2c55585e88",
          "name": "iOS 16.5 Beta 3 - Security-sysdiagnose v2 vt graph",
          "description": "",
          "modified": "2023-12-06T15:57:12.220000",
          "created": "2023-12-06T15:57:12.220000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "FileHash-SHA256": 1094,
            "domain": 253,
            "hostname": 624,
            "URL": 1545,
            "FileHash-MD5": 59,
            "FileHash-SHA1": 79
          },
          "indicator_count": 3656,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657099644208c92832a9ae92",
          "name": "those ip's JL v2 all suggested ioc's - Data you got \ud83d\ude1c\ud83e\udd37\u200d\u2640\ufe0f",
          "description": "",
          "modified": "2023-12-06T15:55:15.497000",
          "created": "2023-12-06T15:55:15.497000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 4582,
            "FileHash-SHA256": 2374,
            "CVE": 5,
            "domain": 3456,
            "URL": 14212,
            "FileHash-MD5": 13,
            "FileHash-SHA1": 13
          },
          "indicator_count": 24655,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a980f14b5a32303bf865b",
          "name": "CNC server.telegrafix.com",
          "description": "",
          "modified": "2023-12-02T02:35:59.820000",
          "created": "2023-12-02T02:35:59.820000",
          "tags": [
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "server",
            "whois lookup",
            "creation date",
            "dnssec",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "date",
            "whois lookups",
            "iana id",
            "domain status",
            "registrar url",
            "registrar whois",
            "first",
            "execution",
            "tsara brashears",
            "ssl certificate",
            "april",
            "threat roundup",
            "october",
            "december",
            "roundup",
            "september",
            "whois record",
            "blustealer",
            "raspberry robin",
            "redline stealer",
            "gopuram",
            "hacktool",
            "skynet",
            "android",
            "quasar",
            "download",
            "malware",
            "hijacker",
            "monitoring",
            "installer",
            "ermac",
            "attack",
            "blackguard",
            "core",
            "awful",
            "twitter",
            "agent tesla",
            "trickbot",
            "ursnif",
            "chaos",
            "metasploit",
            "formbook",
            "metro",
            "name verdict",
            "exit",
            "traffic",
            "node tcp",
            "et tor",
            "known tor",
            "relayrouter",
            "united",
            "team malware",
            "firehol et",
            "tor known",
            "redline",
            "detection list",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malicious url",
            "blacklist",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "contacted",
            "bundled",
            "project",
            "ransomexx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Lithuania"
          ],
          "malware_families": [
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65423978ca5e5c9931b586a5",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3674,
            "domain": 1422,
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 3178,
            "URL": 8884,
            "email": 2,
            "CVE": 3,
            "FileHash-MD5": 167
          },
          "indicator_count": 17447,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "870 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a978cf39ec3cdc99278cc",
          "name": "RedLine",
          "description": "",
          "modified": "2023-12-02T02:33:48.848000",
          "created": "2023-12-02T02:33:48.848000",
          "tags": [
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "server",
            "whois lookup",
            "creation date",
            "dnssec",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "date",
            "whois lookups",
            "iana id",
            "domain status",
            "registrar url",
            "registrar whois",
            "first",
            "execution",
            "tsara brashears",
            "ssl certificate",
            "april",
            "threat roundup",
            "october",
            "december",
            "roundup",
            "september",
            "whois record",
            "blustealer",
            "raspberry robin",
            "redline stealer",
            "gopuram",
            "hacktool",
            "skynet",
            "android",
            "quasar",
            "download",
            "malware",
            "hijacker",
            "monitoring",
            "installer",
            "ermac",
            "attack",
            "blackguard",
            "core",
            "awful",
            "twitter",
            "agent tesla",
            "trickbot",
            "ursnif",
            "chaos",
            "metasploit",
            "formbook",
            "metro",
            "name verdict",
            "exit",
            "traffic",
            "node tcp",
            "et tor",
            "known tor",
            "relayrouter",
            "united",
            "team malware",
            "firehol et",
            "tor known",
            "redline",
            "detection list",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malicious url",
            "blacklist",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "contacted",
            "bundled",
            "project",
            "ransomexx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Lithuania"
          ],
          "malware_families": [
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65423a941aa6527fbbe40a53",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3674,
            "domain": 1422,
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 3178,
            "URL": 8884,
            "email": 2,
            "CVE": 3,
            "FileHash-MD5": 167
          },
          "indicator_count": 17447,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "870 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6545a281ce7426288033f81e",
          "name": "CNC server.telegrafix.com",
          "description": "",
          "modified": "2023-12-01T10:01:56.921000",
          "created": "2023-11-04T01:46:41.933000",
          "tags": [
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "server",
            "whois lookup",
            "creation date",
            "dnssec",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "date",
            "whois lookups",
            "iana id",
            "domain status",
            "registrar url",
            "registrar whois",
            "first",
            "execution",
            "tsara brashears",
            "ssl certificate",
            "april",
            "threat roundup",
            "october",
            "december",
            "roundup",
            "september",
            "whois record",
            "blustealer",
            "raspberry robin",
            "redline stealer",
            "gopuram",
            "hacktool",
            "skynet",
            "android",
            "quasar",
            "download",
            "malware",
            "hijacker",
            "monitoring",
            "installer",
            "ermac",
            "attack",
            "blackguard",
            "core",
            "awful",
            "twitter",
            "agent tesla",
            "trickbot",
            "ursnif",
            "chaos",
            "metasploit",
            "formbook",
            "metro",
            "name verdict",
            "exit",
            "traffic",
            "node tcp",
            "et tor",
            "known tor",
            "relayrouter",
            "united",
            "team malware",
            "firehol et",
            "tor known",
            "redline",
            "detection list",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malicious url",
            "blacklist",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "contacted",
            "bundled",
            "project",
            "ransomexx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Lithuania"
          ],
          "malware_families": [
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65423978ca5e5c9931b586a5",
          "export_count": 46,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3674,
            "domain": 1422,
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 3178,
            "URL": 8884,
            "email": 2,
            "CVE": 3,
            "FileHash-MD5": 167
          },
          "indicator_count": 17447,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65423a941aa6527fbbe40a53",
          "name": "RedLine",
          "description": "CNC server.telegrafix.com. Brute force passwords using SSH on server RELAY\nTargeted individual, monitoring, hacking, CNC, remoted devices, tracking, malware attack,etc.\n(Auto populated: The last HTTPS certificate was signed by the US government's Department of Homeland Security (DHS), but what exactly is it and what does the certificate actually say?. and how does it look?)",
          "modified": "2023-12-01T10:01:56.921000",
          "created": "2023-11-01T11:46:28.418000",
          "tags": [
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "server",
            "whois lookup",
            "creation date",
            "dnssec",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "date",
            "whois lookups",
            "iana id",
            "domain status",
            "registrar url",
            "registrar whois",
            "first",
            "execution",
            "tsara brashears",
            "ssl certificate",
            "april",
            "threat roundup",
            "october",
            "december",
            "roundup",
            "september",
            "whois record",
            "blustealer",
            "raspberry robin",
            "redline stealer",
            "gopuram",
            "hacktool",
            "skynet",
            "android",
            "quasar",
            "download",
            "malware",
            "hijacker",
            "monitoring",
            "installer",
            "ermac",
            "attack",
            "blackguard",
            "core",
            "awful",
            "twitter",
            "agent tesla",
            "trickbot",
            "ursnif",
            "chaos",
            "metasploit",
            "formbook",
            "metro",
            "name verdict",
            "exit",
            "traffic",
            "node tcp",
            "et tor",
            "known tor",
            "relayrouter",
            "united",
            "team malware",
            "firehol et",
            "tor known",
            "redline",
            "detection list",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malicious url",
            "blacklist",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "contacted",
            "bundled",
            "project",
            "ransomexx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Lithuania"
          ],
          "malware_families": [
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3674,
            "domain": 1422,
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 3178,
            "URL": 8884,
            "email": 2,
            "CVE": 3,
            "FileHash-MD5": 167
          },
          "indicator_count": 17447,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65423978ca5e5c9931b586a5",
          "name": "CNC server.telegrafix.com",
          "description": "Brute force passwords using SSH on server RELAY\nTargeted individual, adult content, malvertizing, keylogging, monitoring, hacking, CNC, remoted devices, tracking, malware attack,etc.\n(Auto populated: The last HTTPS certificate was signed by the US government's Department of Homeland Security (DHS), but what exactly is it and what does the certificate actually say?. and how does it look?)",
          "modified": "2023-12-01T10:01:56.921000",
          "created": "2023-11-01T11:41:44.861000",
          "tags": [
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "server",
            "whois lookup",
            "creation date",
            "dnssec",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "date",
            "whois lookups",
            "iana id",
            "domain status",
            "registrar url",
            "registrar whois",
            "first",
            "execution",
            "tsara brashears",
            "ssl certificate",
            "april",
            "threat roundup",
            "october",
            "december",
            "roundup",
            "september",
            "whois record",
            "blustealer",
            "raspberry robin",
            "redline stealer",
            "gopuram",
            "hacktool",
            "skynet",
            "android",
            "quasar",
            "download",
            "malware",
            "hijacker",
            "monitoring",
            "installer",
            "ermac",
            "attack",
            "blackguard",
            "core",
            "awful",
            "twitter",
            "agent tesla",
            "trickbot",
            "ursnif",
            "chaos",
            "metasploit",
            "formbook",
            "metro",
            "name verdict",
            "exit",
            "traffic",
            "node tcp",
            "et tor",
            "known tor",
            "relayrouter",
            "united",
            "team malware",
            "firehol et",
            "tor known",
            "redline",
            "detection list",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malicious url",
            "blacklist",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "contacted",
            "bundled",
            "project",
            "ransomexx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Lithuania"
          ],
          "malware_families": [
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3674,
            "domain": 1422,
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 3178,
            "URL": 8884,
            "email": 2,
            "CVE": 3,
            "FileHash-MD5": 167
          },
          "indicator_count": 17447,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f19afc40e663452f60260",
          "name": "DNSpionage",
          "description": "",
          "modified": "2023-11-13T12:00:59.446000",
          "created": "2023-10-30T02:49:19.586000",
          "tags": [
            "referrer",
            "historical ssl",
            "ssl certificate",
            "whois record",
            "whois ssl",
            "whois",
            "historical",
            "siblings parent",
            "network",
            "number",
            "label shanghai",
            "blue cloud",
            "ltd regional",
            "apnic country",
            "cn continent",
            "algorithm",
            "data",
            "v3 serial",
            "cus cndigicert",
            "basic rsa",
            "cn ca",
            "g2 odigicert",
            "inc validity",
            "oshanghai blue",
            "road",
            "beijing country",
            "beijing",
            "please",
            "apnic person",
            "cn phone",
            "whois lookup",
            "bluecloud descr",
            "shanghai blue",
            "ltd descr",
            "cnnic",
            "whois lookups",
            "updated date",
            "apnic netname",
            "beijing abusec",
            "abuse cnniccn",
            "liu registrant",
            "country",
            "dns replication",
            "date",
            "domain",
            "first",
            "blacklist https",
            "heur",
            "html",
            "malware",
            "alexa top",
            "site",
            "filerepmetagen",
            "suspected",
            "adware",
            "cisco umbrella",
            "malware site",
            "win64",
            "opencandy",
            "cleaner",
            "artemis",
            "iframe",
            "agent",
            "unsafe",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "exploit",
            "presenoker",
            "filetour",
            "conduit",
            "wacatac",
            "softcnapp",
            "xtrat",
            "cve201711882",
            "memscan",
            "phishing",
            "maltiverse",
            "zbot",
            "webtoolbar",
            "trojanspy",
            "million",
            "united",
            "phishing site",
            "malicious site",
            "proxy",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "safe site",
            "team",
            "fusioncore",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "alexa",
            "adposhel",
            "installpack",
            "xrat",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "gamehack",
            "verdict",
            "falcon sandbox",
            "pattern match",
            "show",
            "file",
            "indicator",
            "ascii text",
            "appdata",
            "mitre att",
            "et tor",
            "known tor",
            "severity",
            "hybrid",
            "general",
            "misc attack",
            "beginstring",
            "script",
            "relayrouter",
            "exit",
            "node traffic",
            "null",
            "error",
            "unknown",
            "span",
            "body",
            "refresh",
            "class",
            "critical",
            "tools",
            "look",
            "verify",
            "restart",
            "click",
            "strings",
            "meta",
            "anonymizer",
            "team proxy",
            "host",
            "control server",
            "meterpreter",
            "dnspionage",
            "filerepmalware",
            "fakealert",
            "pony",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "patcher",
            "adload",
            "webcompanion",
            "seraph",
            "downloader",
            "generic",
            "dapato",
            "redline stealer",
            "beach research",
            "blacklist http",
            "generic malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "bundled",
            "dropped",
            "contacted",
            "most malicious",
            "server",
            "parent parent"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Behav",
              "display_name": "Behav",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "652a9637ba159a3febc414c4",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2420,
            "FileHash-SHA1": 189,
            "FileHash-SHA256": 3307,
            "URL": 1933,
            "domain": 255,
            "hostname": 1083,
            "CIDR": 1,
            "email": 4,
            "CVE": 27
          },
          "indicator_count": 9219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "889 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652a913f48809612f1bd7deb",
          "name": "Oshanghai Blue ",
          "description": "",
          "modified": "2023-11-13T12:00:59.446000",
          "created": "2023-10-14T13:01:51.164000",
          "tags": [
            "referrer",
            "historical ssl",
            "ssl certificate",
            "whois record",
            "whois ssl",
            "whois",
            "historical",
            "siblings parent",
            "network",
            "number",
            "label shanghai",
            "blue cloud",
            "ltd regional",
            "apnic country",
            "cn continent",
            "algorithm",
            "data",
            "v3 serial",
            "cus cndigicert",
            "basic rsa",
            "cn ca",
            "g2 odigicert",
            "inc validity",
            "oshanghai blue",
            "road",
            "beijing country",
            "beijing",
            "please",
            "apnic person",
            "cn phone",
            "whois lookup",
            "bluecloud descr",
            "shanghai blue",
            "ltd descr",
            "cnnic",
            "whois lookups",
            "updated date",
            "apnic netname",
            "beijing abusec",
            "abuse cnniccn",
            "liu registrant",
            "country",
            "dns replication",
            "date",
            "domain",
            "first",
            "blacklist https",
            "heur",
            "html",
            "malware",
            "alexa top",
            "site",
            "filerepmetagen",
            "suspected",
            "adware",
            "cisco umbrella",
            "malware site",
            "win64",
            "opencandy",
            "cleaner",
            "artemis",
            "iframe",
            "agent",
            "unsafe",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "exploit",
            "presenoker",
            "filetour",
            "conduit",
            "wacatac",
            "softcnapp",
            "xtrat",
            "cve201711882",
            "memscan",
            "phishing",
            "maltiverse",
            "zbot",
            "webtoolbar",
            "trojanspy",
            "million",
            "united",
            "phishing site",
            "malicious site",
            "proxy",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "safe site",
            "team",
            "fusioncore",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "alexa",
            "adposhel",
            "installpack",
            "xrat",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "gamehack",
            "verdict",
            "falcon sandbox",
            "pattern match",
            "show",
            "file",
            "indicator",
            "ascii text",
            "appdata",
            "mitre att",
            "et tor",
            "known tor",
            "severity",
            "hybrid",
            "general",
            "misc attack",
            "beginstring",
            "script",
            "relayrouter",
            "exit",
            "node traffic",
            "null",
            "error",
            "unknown",
            "span",
            "body",
            "refresh",
            "class",
            "critical",
            "tools",
            "look",
            "verify",
            "restart",
            "click",
            "strings",
            "meta",
            "anonymizer",
            "team proxy",
            "host",
            "control server",
            "meterpreter",
            "dnspionage",
            "filerepmalware",
            "fakealert",
            "pony",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "patcher",
            "adload",
            "webcompanion",
            "seraph",
            "downloader",
            "generic",
            "dapato",
            "redline stealer",
            "beach research",
            "blacklist http",
            "generic malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "bundled",
            "dropped",
            "contacted",
            "most malicious",
            "server",
            "parent parent"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Behav",
              "display_name": "Behav",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "652a901fe2dbea9024b3d614",
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2420,
            "FileHash-SHA1": 189,
            "FileHash-SHA256": 3307,
            "URL": 1933,
            "domain": 255,
            "hostname": 1083,
            "CIDR": 1,
            "email": 4,
            "CVE": 27
          },
          "indicator_count": 9219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "889 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652a9441becbdf690c095816",
          "name": "27 CVE Talley | GameHack l Beach Research",
          "description": "",
          "modified": "2023-11-13T12:00:59.446000",
          "created": "2023-10-14T13:14:41.530000",
          "tags": [
            "referrer",
            "historical ssl",
            "ssl certificate",
            "whois record",
            "whois ssl",
            "whois",
            "historical",
            "siblings parent",
            "network",
            "number",
            "label shanghai",
            "blue cloud",
            "ltd regional",
            "apnic country",
            "cn continent",
            "algorithm",
            "data",
            "v3 serial",
            "cus cndigicert",
            "basic rsa",
            "cn ca",
            "g2 odigicert",
            "inc validity",
            "oshanghai blue",
            "road",
            "beijing country",
            "beijing",
            "please",
            "apnic person",
            "cn phone",
            "whois lookup",
            "bluecloud descr",
            "shanghai blue",
            "ltd descr",
            "cnnic",
            "whois lookups",
            "updated date",
            "apnic netname",
            "beijing abusec",
            "abuse cnniccn",
            "liu registrant",
            "country",
            "dns replication",
            "date",
            "domain",
            "first",
            "blacklist https",
            "heur",
            "html",
            "malware",
            "alexa top",
            "site",
            "filerepmetagen",
            "suspected",
            "adware",
            "cisco umbrella",
            "malware site",
            "win64",
            "opencandy",
            "cleaner",
            "artemis",
            "iframe",
            "agent",
            "unsafe",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "tiggre",
            "genkryptik",
            "exploit",
            "presenoker",
            "filetour",
            "conduit",
            "wacatac",
            "softcnapp",
            "xtrat",
            "cve201711882",
            "memscan",
            "phishing",
            "maltiverse",
            "zbot",
            "webtoolbar",
            "trojanspy",
            "million",
            "united",
            "phishing site",
            "malicious site",
            "proxy",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "safe site",
            "team",
            "fusioncore",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "alexa",
            "adposhel",
            "installpack",
            "xrat",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "gamehack",
            "verdict",
            "falcon sandbox",
            "pattern match",
            "show",
            "file",
            "indicator",
            "ascii text",
            "appdata",
            "mitre att",
            "et tor",
            "known tor",
            "severity",
            "hybrid",
            "general",
            "misc attack",
            "beginstring",
            "script",
            "relayrouter",
            "exit",
            "node traffic",
            "null",
            "error",
            "unknown",
            "span",
            "body",
            "refresh",
            "class",
            "critical",
            "tools",
            "look",
            "verify",
            "restart",
            "click",
            "strings",
            "meta",
            "anonymizer",
            "team proxy",
            "host",
            "control server",
            "meterpreter",
            "dnspionage",
            "filerepmalware",
            "fakealert",
            "pony",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "patcher",
            "adload",
            "webcompanion",
            "seraph",
            "downloader",
            "generic",
            "dapato",
            "redline stealer",
            "beach research",
            "blacklist http",
            "generic malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "bundled",
            "dropped",
            "contacted",
            "most malicious",
            "server",
            "parent parent"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Behav",
              "display_name": "Behav",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "652a901fe2dbea9024b3d614",
          "export_count": 34,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2420,
            "FileHash-SHA1": 189,
            "FileHash-SHA256": 3307,
            "URL": 1933,
            "domain": 255,
            "hostname": 1083,
            "CIDR": 1,
            "email": 4,
            "CVE": 27
          },
          "indicator_count": 9219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "889 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "45.159.189.105                                                (Command and Control)",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "37.48.65.150           |  command and control",
        "www.jamesbgriffinlaw.com                     (malicious host)",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "remote.telegrafix.com          (remote hacking)",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "Roksit.net",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel | Dangerous Malware",
        "5b574f4989724909s@anonymised.email      | contact information seems evasive and illegitimate",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "00000000.apple.com  | remote SIM Swap",
        "45.56.79.23             |  command and control",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://twitter.com/PORNO_SEXYBABES.                | Botnetwork T-Mobile attack",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "ocsp2.apple.com | IP 17.253.29.199",
        "nr-data.net | Apple Private Data Collection",
        "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
        "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "103.246.145.111      | scanning host",
        "init.ess.apple.com        (remote hacking)",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "CA Issuers - http://certs.apple.com/apsecc12g1.der OCSP - http://ocsp.apple.com/ocsp03-apsecc12g101 X509v3 Basic Constraints: CA:FALSE",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
        "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
        "stagelight.pl                                                 (malicious/ pattern match)",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://init-p01st.push.apple.com/bag        (remote hacking)",
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://sinister.ly/Thread-Apple-empty-box?page=13",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "Data Analytics",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "dns.trackgroup.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "https://tulach.cc/  | phishing",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "applepaydayloans.com",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "http://ww1.tsx.org/_fd",
        "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
        "72.14.178.174           |  command and control",
        "nr-data.net | Apple Private Data collection",
        "https://applemusic-spotlight.myunidays.com/US/en-US?  | \"Zero Click\" remote attack \u2022 enters through Apple apps ( apple tv, iTunes,etc)",
        "firebaseremoteconfig.googleapis.com     (remote hacking)",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "https://www.roseoubleu.fr/panier        (phishing)",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "198.58.118.167        |  command and control",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "http://www.Apple.com/quicktime/download",
        "Behavior Pattern Match Analysis",
        "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
        "message.htm.com   | malware ransomware spreader",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
        "deadlyexploits.com | deadlysymbol.com |",
        "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "185.107.56.200       |  command and control",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
        "https://safebae.org/",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "apple.com.        (malicious version/header)",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86",
        "tulach.cc.               | Malicious compromises \u2022 Critical",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
        "45.33.18.44             |  command and control",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "72.14.185.43            |  command and control",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
        "www.hallrender.com",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  | Apple password cracker \u2022 Cyber attack targeting SA victim",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "http://michaela.young@uchealth.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "9.6.zip - SQLi",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
        "nr-data.net [Apple Private Data Collection]",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "20.99.186.246        |  command and contro",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "remote.haverhillcc.com        (remote hacking)",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com",
        "uchealth.com",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "172.93.103.100        |  command and control",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
        "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
        "45.79.19.196            |  command and control",
        "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "45.33.23.183            |  command and control",
        "103.246.145.111  - scanning host",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "http://www.01tracks.com/happy-customers",
        "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.apple.com/sitemap/",
        "s3.amazonaws.com [ metro T-Mobile spyware porn]",
        "5.79.79.211              |  command and control",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "45.33.20.235           |  command and control",
        "96.126.123.244       |  command and control",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
        "https://apps.apple.com/us/app/samsung-galaxy-watch-gear-s/id1117310635    | App argument",
        "http://45.159.189.105/bot/regex            (Bot Command)",
        "103.246.145.111 phishing",
        "apple.com      | malicious \u2022 geo tracking",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "drip.colorado.edu = colorado.edu @ University of Colorado Boulder",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "45.33.30.197            |  command and control",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://www.Apple.com/quicktime/download/standalone.html",
        "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635  | Blog",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
        "scripting-sandbox-dns.bunny.net",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "https://www.hybrid-analysis.com/sample/c52df9e010faa90f567fb29345b551506398b450a3c68c64e40f337b7b054bca",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "ussjc9-edge-bx-008.ts.apple.com   | malware",
        "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
        "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/            | phishing attack \u2022 retaliation after alleged SA by Doctor of Physical Therapy",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://support.Apple.com/de",
        "45.33.2.79               |  command and control",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "https://applepaydayloans.com/",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Brian Sabey | Tulach | Sabey Data Centers"
          ],
          "malware_families": [
            "Generic.31fcc75f",
            "Malicious.22a4c0",
            "Trojan:win32/muldrop",
            "Proxy",
            "Behav",
            "Alf:program:opencandy:remnant",
            "Malware.generic",
            "Adwaresig [adw] ml.generic",
            "Qvm20.1.8d80.malware",
            "Blacknet rat",
            "Bazarcall",
            "Malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tunsafe.ai_score_98% 1\tmobigame 1\tbanker,evasive,retefe 1\tprogram.unwanted 1\tmalicious.high.ml 1\tkryptik.dawvk 1\tunsafe.ai_score_91% 1\tadwar",
            "Brontok",
            "Njrat",
            "Anonymizer",
            "Ml.generic",
            "Artemis",
            "Cobalt strike - s0154",
            "Trojan.html.agent",
            "Pegasus",
            "W32.hack.generic",
            "Adware.dropware",
            "Emotet",
            "Et",
            "Skynet",
            "Qakbot",
            "Tel:delphi/obfuscator",
            "Win32/tofsee.ax",
            "Gen:variant.bulz",
            "Ransomexx",
            "Gen:variant.razy",
            "Callback phishing",
            "Generic.asmalws          malicious_confidence_70% 1\til:trojan.msilzilla 1\tfilerepmalware 1\transom.sabsik 1\tbehaveslike.dropper 1\tmicrosoft phishing 1\tbackdoor.mokes 1\tphishing bank of america corporat",
            "Phish.ab",
            "Beach research",
            "Opencandy",
            "Trojanspy",
            "Network rat",
            "Ransomware",
            "Undefined 1\tms 1\txyz 1\tgl 1\tnet tld aggregation com ms xyz gl net 20% 20% 20% 20% 20% tld\tcount com\t1 undefined\tnan ms\t1 xyz\t1 gl\t1 net\t1   combined blacklist timeline hybrid-analysis maltiverse resea",
            "Gen:variant.zusy",
            "Redline stealer",
            "Generic.malware",
            "Trojan.ransom.generickd",
            "Neworder.doc",
            "Maltiverse",
            "Relic",
            "Generic",
            "Raccoon",
            "Tel:trojan:win32/emotet",
            "Keyloggers",
            "Pws:msil/steam",
            "Backdoor.mokes",
            "#hstr:hacktool:win32/mimikatz",
            "Sdbot.caoc",
            "Laplasclipper",
            "Ramnit",
            "Lumma stealer",
            "Quasar rat",
            "Gamehack",
            "Nimnul",
            "Redline",
            "Trojan.generic",
            "Trojan.ole2.vbs",
            "Slfper:installcore",
            "Dropper.binder",
            "#lowfi:siga:trojanspy:msil/keylogger",
            "Ratel",
            "Mimikatz",
            "Meterpreter",
            "Gamehack.dr",
            "Trojanx",
            "Botnet army",
            "Worm:win32/netsky",
            "Webtoolbar",
            "Zbot",
            "Trojan.mirai/genericrxui",
            "Hacktool",
            "Sodin ransomware",
            "Tulach malware",
            "Unruy"
          ],
          "industries": [
            "Healthcare",
            "Telecommunications",
            "Public",
            "Education"
          ],
          "unique_indicators": 143141
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/mails-apple.com",
    "whois": "http://whois.domaintools.com/mails-apple.com",
    "domain": "mails-apple.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 50,
  "pulses": [
    {
      "id": "69d68fffbf012630d57033b6",
      "name": "Sabey SWIPPER - Pornhub\u00bbX.Com migration to Twitter | Sabey\u2019s Daddy Data Center ",
      "description": "",
      "modified": "2026-04-08T17:27:27.851000",
      "created": "2026-04-08T17:27:27.851000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69bea426487bffa5384c6f38",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "12 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bea426487bffa5384c6f38",
      "name": " Brian Sabey illegally deleting IoC\u2019s | SWIPPER - Pornhub\u00bbX.Com migration to Twitter Sabey Erasing",
      "description": "",
      "modified": "2026-03-21T13:59:02.016000",
      "created": "2026-03-21T13:59:02.016000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "30 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a9e7c572b8411d126215a6",
      "name": "@scoreblue callback clone",
      "description": "",
      "modified": "2026-03-06T05:11:18.020000",
      "created": "2026-03-05T20:29:57.169000",
      "tags": [
        "acceptencoding",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers xcache",
        "wp engine",
        "threat",
        "paste",
        "iocs",
        "urls https",
        "samples",
        "contacted",
        "apple",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "referrer",
        "execution",
        "tsara brashears",
        "apple ios",
        "historical",
        "communicating",
        "copy",
        "attack",
        "njrat",
        "ransomware",
        "hacktool",
        "metro",
        "malicious",
        "crypto",
        "installer",
        "awful",
        "startpage",
        "callback phishing",
        "safebae",
        "catherine daisy coleman",
        "pegasus",
        "nso",
        "kb font",
        "january",
        "http",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "kb document",
        "general full",
        "url http",
        "low risk",
        "sucuri firewall",
        "malware found",
        "site",
        "unknown",
        "low security",
        "risk",
        "website malware",
        "security no",
        "protect",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "no data",
        "tag count",
        "sample summary",
        "sample",
        "detection list",
        "blacklist",
        "count blacklist",
        "tag tag",
        "anchor hrefs",
        "wordpress",
        "html info",
        "title safebae",
        "anyone else",
        "meta tags",
        "wpbakery page",
        "builder",
        "slider plugin",
        "script tags",
        "passive dns",
        "urls",
        "a nxdomain",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "united",
        "status",
        "as13768 aptum",
        "date",
        "moved",
        "creation date",
        "search",
        "record value",
        "body",
        "log id",
        "gmtn",
        "go daddy",
        "authority",
        "tls web",
        "arizona",
        "scottsdale",
        "ca issuers",
        "false",
        "as30148 sucuri",
        "a domains",
        "gmt content",
        "ipv4",
        "win64",
        "back",
        "linux mint",
        "hacking",
        "brian sabey",
        "tracking",
        "hallrender",
        "staging",
        "dns",
        "network",
        "control",
        "bazar"
      ],
      "references": [
        "https://safebae.org/",
        "www.hallrender.com",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
        "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
        "s3.amazonaws.com [ metro T-Mobile spyware porn]",
        "9.6.zip - SQLi",
        "dns.trackgroup.net",
        "nr-data.net [Apple Private Data Collection]",
        "scripting-sandbox-dns.bunny.net",
        "http://www.01tracks.com/happy-customers",
        "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
        "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
        "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
        "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
        "deadlyexploits.com | deadlysymbol.com |",
        "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Callback Phishing",
          "display_name": "Callback Phishing",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "BazarCall",
          "display_name": "BazarCall",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1029",
          "name": "Scheduled Transfer",
          "display_name": "T1029 - Scheduled Transfer"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65b8a052c4160dbd76054f8a",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2802,
        "URL": 3267,
        "domain": 1459,
        "hostname": 1268,
        "FileHash-MD5": 227,
        "FileHash-SHA1": 144,
        "CVE": 2,
        "email": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 9172,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 50,
      "modified_text": "45 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68888ed9c3a537ac4491eba7",
      "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration [scoreblue]",
      "description": "",
      "modified": "2025-07-29T09:05:29.205000",
      "created": "2025-07-29T09:05:29.205000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "265 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d4916fa7338286448118a1",
      "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com migration to Twitter ",
      "description": "",
      "modified": "2024-10-19T18:02:34.237000",
      "created": "2024-09-01T16:08:15.260000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ccbd92f716bb0ca0fda93d",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 935,
        "URL": 5882,
        "domain": 571,
        "hostname": 1418,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 9054,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "548 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6523344e4adc85389899504c",
      "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
      "description": "",
      "modified": "2024-10-13T03:00:28.081000",
      "created": "2023-10-08T22:59:26.040000",
      "tags": [
        "united",
        "contacted urls",
        "whois record",
        "contacted",
        "malicious site",
        "malware",
        "phishing site",
        "anonymizer",
        "heur",
        "control server",
        "facebook",
        "cobalt strike",
        "execution",
        "installcore",
        "phishing",
        "service",
        "core",
        "metro",
        "icmp",
        "hacktool",
        "download",
        "relic",
        "monitoring",
        "installer",
        "steam",
        "bank",
        "dnspionage",
        "crack",
        "unsafe",
        "ramnit",
        "emotet",
        "malware site",
        "proxy",
        "exploit",
        "fakealert",
        "team",
        "redline stealer",
        "laplasclipper",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "alexa",
        "downloader",
        "opencandy",
        "generic",
        "presenoker",
        "maltiverse",
        "trojanspy",
        "date",
        "unknown",
        "windir",
        "markmonitor",
        "name server",
        "av detection",
        "september",
        "default browser",
        "guest system",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "critical",
        "blacklist",
        "union",
        "Embarcadero Delphi",
        "whois whois",
        "referrer",
        "ssl certificate",
        "communicating",
        "resolutions",
        "parent parent",
        "dropped",
        "stealer",
        "banker",
        "keylogger",
        "attack",
        "apple",
        "detection list",
        "ip address",
        "netsky",
        "firehol proxy",
        "noname057",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "FireHol",
        "Proxy",
        "Pexee",
        "Bank of America Corporation Malware Download",
        "CVE-2017-11882",
        "Alexa SANS Internet Storm Center",
        "MCI Verizon Block",
        "NaN"
      ],
      "references": [
        "http://ww1.tsx.org/_fd",
        "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
        "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
        "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
        "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
        "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
        "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
        "firebaseremoteconfig.googleapis.com     (remote hacking)",
        "remote.telegrafix.com          (remote hacking)",
        "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
        "remote.haverhillcc.com        (remote hacking)",
        "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "http://init-p01st.push.apple.com/bag        (remote hacking)",
        "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
        "apple.com.        (malicious version/header)",
        "https://www.apple.com/sitemap/",
        "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "init.ess.apple.com        (remote hacking)",
        "applepaydayloans.com",
        "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
        "https://applepaydayloans.com/",
        "https://sinister.ly/Thread-Apple-empty-box?page=13",
        "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
        "https://support.Apple.com/de",
        "http://www.Apple.com/quicktime/download",
        "http://www.Apple.com/quicktime/download/standalone.html",
        "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
        "https://www.roseoubleu.fr/panier        (phishing)",
        "Roksit.net",
        "stagelight.pl                                                 (malicious/ pattern match)",
        "www.jamesbgriffinlaw.com                     (malicious host)",
        "Data Analytics",
        "Behavior Pattern Match Analysis",
        "45.159.189.105                                                (Command and Control)",
        "http://45.159.189.105/bot/regex            (Bot Command)",
        "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
        "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
        "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
        "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TEL:Delphi/Obfuscator",
          "display_name": "TEL:Delphi/Obfuscator",
          "target": "/malware/TEL:Delphi/Obfuscator"
        },
        {
          "id": "LaplasClipper",
          "display_name": "LaplasClipper",
          "target": null
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "SLFPER:InstallCore",
          "display_name": "SLFPER:InstallCore",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "ALF:Program:OpenCandy:Remnant",
          "display_name": "ALF:Program:OpenCandy:Remnant",
          "target": null
        },
        {
          "id": "Ramnit",
          "display_name": "Ramnit",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        },
        {
          "id": "generic.malware",
          "display_name": "generic.malware",
          "target": null
        },
        {
          "id": "Anonymizer",
          "display_name": "Anonymizer",
          "target": null
        },
        {
          "id": "#HSTR:HackTool:Win32/Mimikatz",
          "display_name": "#HSTR:HackTool:Win32/Mimikatz",
          "target": null
        },
        {
          "id": "PWS:MSIL/Steam",
          "display_name": "PWS:MSIL/Steam",
          "target": "/malware/PWS:MSIL/Steam"
        },
        {
          "id": "Trojan.HTML.Agent",
          "display_name": "Trojan.HTML.Agent",
          "target": null
        },
        {
          "id": "Gen:Variant.Zusy",
          "display_name": "Gen:Variant.Zusy",
          "target": null
        },
        {
          "id": "Worm:Win32/Netsky",
          "display_name": "Worm:Win32/Netsky",
          "target": "/malware/Worm:Win32/Netsky"
        },
        {
          "id": "Sodin Ransomware",
          "display_name": "Sodin Ransomware",
          "target": null
        },
        {
          "id": "Keyloggers",
          "display_name": "Keyloggers",
          "target": null
        },
        {
          "id": "Proxy",
          "display_name": "Proxy",
          "target": null
        },
        {
          "id": "TEL:Trojan:Win32/Emotet",
          "display_name": "TEL:Trojan:Win32/Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike - S0154",
          "display_name": "Cobalt Strike - S0154",
          "target": null
        },
        {
          "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
          "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
          "target": null
        },
        {
          "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
          "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
          "target": null
        },
        {
          "id": "AdwareSig [Adw] ml.Generic",
          "display_name": "AdwareSig [Adw] ml.Generic",
          "target": null
        },
        {
          "id": "W32.Hack.Generic",
          "display_name": "W32.Hack.Generic",
          "target": null
        },
        {
          "id": "Trojan.Ole2.Vbs",
          "display_name": "Trojan.Ole2.Vbs",
          "target": null
        },
        {
          "id": "QVM20.1.8D80.Malware",
          "display_name": "QVM20.1.8D80.Malware",
          "target": null
        },
        {
          "id": "Generic.Malware",
          "display_name": "Generic.Malware",
          "target": null
        },
        {
          "id": "Backdoor.Mokes",
          "display_name": "Backdoor.Mokes",
          "target": null
        },
        {
          "id": "AdWare.DropWare",
          "display_name": "AdWare.DropWare",
          "target": null
        },
        {
          "id": "Gen:Variant.Razy",
          "display_name": "Gen:Variant.Razy",
          "target": null
        },
        {
          "id": "Generic.31fcc75f",
          "display_name": "Generic.31fcc75f",
          "target": null
        },
        {
          "id": "Trojan.Generic",
          "display_name": "Trojan.Generic",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "malware.generic",
          "display_name": "malware.generic",
          "target": null
        },
        {
          "id": "Gen:Variant.Bulz",
          "display_name": "Gen:Variant.Bulz",
          "target": null
        },
        {
          "id": "GameHack.DR",
          "display_name": "GameHack.DR",
          "target": null
        },
        {
          "id": "Dropper.Binder",
          "display_name": "Dropper.Binder",
          "target": null
        },
        {
          "id": "malicious.22a4c0",
          "display_name": "malicious.22a4c0",
          "target": null
        },
        {
          "id": "SdBot.CAOC",
          "display_name": "SdBot.CAOC",
          "target": null
        },
        {
          "id": "ml.Generic",
          "display_name": "ml.Generic",
          "target": null
        },
        {
          "id": "Trojan.Ransom.GenericKD",
          "display_name": "Trojan.Ransom.GenericKD",
          "target": null
        },
        {
          "id": "Phish.AB",
          "display_name": "Phish.AB",
          "target": null
        },
        {
          "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
          "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6506b48d699080b4bfd334c5",
      "export_count": 74,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 7761,
        "CVE": 6,
        "FileHash-MD5": 285,
        "FileHash-SHA1": 165,
        "FileHash-SHA256": 5059,
        "domain": 987,
        "hostname": 2399
      },
      "indicator_count": 16662,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "554 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "670268310c19cecfd0fdce4b",
      "name": "Jeffrey Reimer PT DPT | Brian Sabey - Pornhub Campaigns X.Com",
      "description": "",
      "modified": "2024-10-06T10:36:33.718000",
      "created": "2024-10-06T10:36:33.718000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "561 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66eb08c239be3721ab6c9050",
      "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration to Twitter",
      "description": "",
      "modified": "2024-10-06T10:30:32.632000",
      "created": "2024-09-18T17:07:14.432000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66d4916fa7338286448118a1",
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "561 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "652a901fe2dbea9024b3d614",
      "name": "Black Tech",
      "description": "Found in a malicious Apple iTunes link. Lists several independent artists. Music \"producer\" is potentially highly dependent on use of AI generated instrumentation and conception.  Hacking seems to target a single target and associates.",
      "modified": "2024-09-24T00:01:38.502000",
      "created": "2023-10-14T12:57:03.183000",
      "tags": [
        "referrer",
        "historical ssl",
        "ssl certificate",
        "whois record",
        "whois ssl",
        "whois",
        "historical",
        "siblings parent",
        "network",
        "number",
        "label shanghai",
        "blue cloud",
        "ltd regional",
        "apnic country",
        "cn continent",
        "algorithm",
        "data",
        "v3 serial",
        "cus cndigicert",
        "basic rsa",
        "cn ca",
        "g2 odigicert",
        "inc validity",
        "oshanghai blue",
        "road",
        "beijing country",
        "beijing",
        "please",
        "apnic person",
        "cn phone",
        "whois lookup",
        "bluecloud descr",
        "shanghai blue",
        "ltd descr",
        "cnnic",
        "whois lookups",
        "updated date",
        "apnic netname",
        "beijing abusec",
        "abuse cnniccn",
        "liu registrant",
        "country",
        "dns replication",
        "date",
        "domain",
        "first",
        "blacklist https",
        "heur",
        "html",
        "malware",
        "alexa top",
        "site",
        "filerepmetagen",
        "suspected",
        "adware",
        "cisco umbrella",
        "malware site",
        "win64",
        "opencandy",
        "cleaner",
        "artemis",
        "iframe",
        "agent",
        "unsafe",
        "riskware",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "tiggre",
        "genkryptik",
        "exploit",
        "presenoker",
        "filetour",
        "conduit",
        "wacatac",
        "softcnapp",
        "xtrat",
        "cve201711882",
        "memscan",
        "phishing",
        "maltiverse",
        "zbot",
        "webtoolbar",
        "trojanspy",
        "million",
        "united",
        "phishing site",
        "malicious site",
        "proxy",
        "firehol",
        "detection list",
        "ip address",
        "blacklist",
        "safe site",
        "team",
        "fusioncore",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "installcore",
        "webshell",
        "alexa",
        "adposhel",
        "installpack",
        "xrat",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "gamehack",
        "verdict",
        "falcon sandbox",
        "pattern match",
        "show",
        "file",
        "indicator",
        "ascii text",
        "appdata",
        "mitre att",
        "et tor",
        "known tor",
        "severity",
        "hybrid",
        "general",
        "misc attack",
        "beginstring",
        "script",
        "relayrouter",
        "exit",
        "node traffic",
        "null",
        "error",
        "unknown",
        "span",
        "body",
        "refresh",
        "class",
        "critical",
        "tools",
        "look",
        "verify",
        "restart",
        "click",
        "strings",
        "meta",
        "anonymizer",
        "team proxy",
        "host",
        "control server",
        "meterpreter",
        "dnspionage",
        "filerepmalware",
        "fakealert",
        "pony",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "floxif",
        "patcher",
        "adload",
        "webcompanion",
        "seraph",
        "downloader",
        "generic",
        "dapato",
        "redline stealer",
        "beach research",
        "blacklist http",
        "generic malware",
        "fakedout threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "bundled",
        "dropped",
        "contacted",
        "most malicious",
        "server",
        "parent parent"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "Behav",
          "display_name": "Behav",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 50,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2449,
        "FileHash-SHA1": 217,
        "FileHash-SHA256": 3441,
        "URL": 2044,
        "domain": 258,
        "hostname": 1100,
        "CIDR": 1,
        "email": 4,
        "CVE": 37
      },
      "indicator_count": 9551,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "573 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66ccbd92f716bb0ca0fda93d",
      "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com - allows redirection for member abuse of Crime Victim",
      "description": "",
      "modified": "2024-09-20T03:00:51.533000",
      "created": "2024-08-26T17:38:26.472000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ca36c85ccdb4c97c164228",
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 303,
        "URL": 906,
        "domain": 258,
        "hostname": 308,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 2019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "577 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mails-apple.com/719",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mails-apple.com/719",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776727902.073527
}