{
  "type": "URL",
  "indicator": "https://ml.tongyi13.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ml.tongyi13.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3838685087,
      "indicator": "https://ml.tongyi13.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "686ab98ff0cb9baa4e2b2000",
          "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied  OctoseekPulse)  Attacks SA victims?",
          "description": "",
          "modified": "2025-08-05T21:02:46.419000",
          "created": "2025-07-06T17:59:43.440000",
          "tags": [
            "runtime process",
            "localappdata",
            "size",
            "sha256",
            "sha1",
            "temp",
            "prefetch8",
            "prefetch1",
            "unicode text",
            "type data",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "mitre",
            "writes a pe file header to disc",
            "show process",
            "date",
            "document file",
            "v2 document",
            "ascii text",
            "malicious",
            "local",
            "path",
            "found",
            "ssl certificate",
            "whois record",
            "threat roundup",
            "contacted",
            "october",
            "resolutions",
            "apple ios",
            "referrer",
            "communicating",
            "execution",
            "june",
            "august",
            "emotet",
            "qakbot",
            "agent tesla",
            "azorult",
            "core",
            "maze",
            "metro",
            "dark",
            "team",
            "critical",
            "copy",
            "awful",
            "ursnif",
            "hacktool",
            "info",
            "qbot",
            "april",
            "njrat",
            "nokoyawa",
            "djvu",
            "flubot",
            "ransomware",
            "bandit stealer",
            "hallrender",
            "spyware",
            "safebae",
            "tsara brashears",
            "westlaw",
            "river.rocks",
            "brian sabey",
            "targeting",
            "dnspionage",
            "united",
            "unknown",
            "search",
            "aaaa",
            "showing",
            "domain",
            "creation date",
            "record value",
            "dnssec",
            "body",
            "passive dns",
            "encrypt",
            "as14061",
            "germany unknown",
            "as397240",
            "gmt server",
            "443 ma2592000",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "main",
            "installing",
            "as16276",
            "france unknown",
            "name servers",
            "as8075",
            "servers",
            "next",
            "as63949 linode",
            "as206834 team",
            "canada unknown",
            "status",
            "as61969 team",
            "msie",
            "chrome",
            "ransom",
            "gone",
            "title",
            "head body",
            "malware"
          ],
          "references": [
            "\u2193\u2192Found in: https://house.mo.gov/\u2193",
            "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
            "demo.auth.civicalg.com.sni.cloudflaressl.com",
            "happyrabbit.kr [Apple iOS threat]",
            "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
            "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
            "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
            "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
            "http://nudeteenporn.site"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Nokoyawa Ransomware",
              "display_name": "Nokoyawa Ransomware",
              "target": null
            },
            {
              "id": "Bandit Stealer",
              "display_name": "Bandit Stealer",
              "target": null
            },
            {
              "id": "FluBot",
              "display_name": "FluBot",
              "target": null
            },
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Djvu",
              "display_name": "Djvu",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1065",
              "name": "Uncommonly Used Port",
              "display_name": "T1065 - Uncommonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65c96df8fe0657d56a206a49",
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 251,
            "FileHash-SHA1": 211,
            "FileHash-SHA256": 3226,
            "domain": 1867,
            "URL": 10030,
            "hostname": 2919,
            "CVE": 7,
            "email": 6
          },
          "indicator_count": 18517,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "257 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c96df8fe0657d56a206a49",
          "name": "Nokoyawa Ransomware - https://house.mo.gov/",
          "description": "Cyber attack including Pegasus found in https://house.mo.gov/\nThis Observed links: dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/Appears to attacking with heightened privilege escalation.\nLinks originated from https://safebae.org attack,  various Westlaw links and links attacking a private citizen. HallRender is malware hosting domain featuring an aggressive  'Brian Sabey' representing self as attorney protecting white collar individuals accused of SA is attacker. Boldly contacts victims via mail, email, phone, text, invites, personal invitations to office. \n\nFront facing https://safebae.org, a 'tribute' domain may mention alleged SA victim Daisy Coleman. Research confirms no mention of 'Daisy' safebae is filled with cyber bullying toolkit; ransomware.csv, tracking, westlaw, tagging tools, pornhub, rallypoint,  adult malvertizing content targeting a Colorado SA victim. \nIt's all very real but so unbelievable. Malware spreading, cyberthreat",
          "modified": "2024-03-13T00:02:54.335000",
          "created": "2024-02-12T01:01:44.323000",
          "tags": [
            "runtime process",
            "localappdata",
            "size",
            "sha256",
            "sha1",
            "temp",
            "prefetch8",
            "prefetch1",
            "unicode text",
            "type data",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "mitre",
            "writes a pe file header to disc",
            "show process",
            "date",
            "document file",
            "v2 document",
            "ascii text",
            "malicious",
            "local",
            "path",
            "found",
            "ssl certificate",
            "whois record",
            "threat roundup",
            "contacted",
            "october",
            "resolutions",
            "apple ios",
            "referrer",
            "communicating",
            "execution",
            "june",
            "august",
            "emotet",
            "qakbot",
            "agent tesla",
            "azorult",
            "core",
            "maze",
            "metro",
            "dark",
            "team",
            "critical",
            "copy",
            "awful",
            "ursnif",
            "hacktool",
            "info",
            "qbot",
            "april",
            "njrat",
            "nokoyawa",
            "djvu",
            "flubot",
            "ransomware",
            "bandit stealer",
            "hallrender",
            "spyware",
            "safebae",
            "tsara brashears",
            "westlaw",
            "river.rocks",
            "brian sabey",
            "targeting",
            "dnspionage",
            "united",
            "unknown",
            "search",
            "aaaa",
            "showing",
            "domain",
            "creation date",
            "record value",
            "dnssec",
            "body",
            "passive dns",
            "encrypt",
            "as14061",
            "germany unknown",
            "as397240",
            "gmt server",
            "443 ma2592000",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "main",
            "installing",
            "as16276",
            "france unknown",
            "name servers",
            "as8075",
            "servers",
            "next",
            "as63949 linode",
            "as206834 team",
            "canada unknown",
            "status",
            "as61969 team",
            "msie",
            "chrome",
            "ransom",
            "gone",
            "title",
            "head body",
            "malware"
          ],
          "references": [
            "\u2193\u2192Found in: https://house.mo.gov/\u2193",
            "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
            "demo.auth.civicalg.com.sni.cloudflaressl.com",
            "happyrabbit.kr [Apple iOS threat]",
            "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
            "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
            "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
            "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
            "http://nudeteenporn.site"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Nokoyawa Ransomware",
              "display_name": "Nokoyawa Ransomware",
              "target": null
            },
            {
              "id": "Bandit Stealer",
              "display_name": "Bandit Stealer",
              "target": null
            },
            {
              "id": "FluBot",
              "display_name": "FluBot",
              "target": null
            },
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Djvu",
              "display_name": "Djvu",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1065",
              "name": "Uncommonly Used Port",
              "display_name": "T1065 - Uncommonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 48,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 194,
            "FileHash-SHA1": 191,
            "FileHash-SHA256": 2376,
            "domain": 1414,
            "URL": 4388,
            "hostname": 1699,
            "CVE": 4,
            "email": 5
          },
          "indicator_count": 10271,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "767 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
        "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
        "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
        "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
        "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
        "http://nudeteenporn.site",
        "\u2193\u2192Found in: https://house.mo.gov/\u2193",
        "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
        "happyrabbit.kr [Apple iOS threat]",
        "demo.auth.civicalg.com.sni.cloudflaressl.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Bandit stealer",
            "Qakbot",
            "Nokoyawa ransomware",
            "Azorult",
            "Qbot",
            "Agent tesla",
            "Ursnif",
            "Maze",
            "Tulach",
            "Dark",
            "Hallrender",
            "Hacktool",
            "Emotet",
            "Flubot",
            "Njrat",
            "Djvu"
          ],
          "industries": [],
          "unique_indicators": 14227
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/tongyi13.com",
    "whois": "http://whois.domaintools.com/tongyi13.com",
    "domain": "tongyi13.com",
    "hostname": "ml.tongyi13.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "686ab98ff0cb9baa4e2b2000",
      "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied  OctoseekPulse)  Attacks SA victims?",
      "description": "",
      "modified": "2025-08-05T21:02:46.419000",
      "created": "2025-07-06T17:59:43.440000",
      "tags": [
        "runtime process",
        "localappdata",
        "size",
        "sha256",
        "sha1",
        "temp",
        "prefetch8",
        "prefetch1",
        "unicode text",
        "type data",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "mitre",
        "writes a pe file header to disc",
        "show process",
        "date",
        "document file",
        "v2 document",
        "ascii text",
        "malicious",
        "local",
        "path",
        "found",
        "ssl certificate",
        "whois record",
        "threat roundup",
        "contacted",
        "october",
        "resolutions",
        "apple ios",
        "referrer",
        "communicating",
        "execution",
        "june",
        "august",
        "emotet",
        "qakbot",
        "agent tesla",
        "azorult",
        "core",
        "maze",
        "metro",
        "dark",
        "team",
        "critical",
        "copy",
        "awful",
        "ursnif",
        "hacktool",
        "info",
        "qbot",
        "april",
        "njrat",
        "nokoyawa",
        "djvu",
        "flubot",
        "ransomware",
        "bandit stealer",
        "hallrender",
        "spyware",
        "safebae",
        "tsara brashears",
        "westlaw",
        "river.rocks",
        "brian sabey",
        "targeting",
        "dnspionage",
        "united",
        "unknown",
        "search",
        "aaaa",
        "showing",
        "domain",
        "creation date",
        "record value",
        "dnssec",
        "body",
        "passive dns",
        "encrypt",
        "as14061",
        "germany unknown",
        "as397240",
        "gmt server",
        "443 ma2592000",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "main",
        "installing",
        "as16276",
        "france unknown",
        "name servers",
        "as8075",
        "servers",
        "next",
        "as63949 linode",
        "as206834 team",
        "canada unknown",
        "status",
        "as61969 team",
        "msie",
        "chrome",
        "ransom",
        "gone",
        "title",
        "head body",
        "malware"
      ],
      "references": [
        "\u2193\u2192Found in: https://house.mo.gov/\u2193",
        "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
        "demo.auth.civicalg.com.sni.cloudflaressl.com",
        "happyrabbit.kr [Apple iOS threat]",
        "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
        "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
        "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
        "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
        "http://nudeteenporn.site"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Nokoyawa Ransomware",
          "display_name": "Nokoyawa Ransomware",
          "target": null
        },
        {
          "id": "Bandit Stealer",
          "display_name": "Bandit Stealer",
          "target": null
        },
        {
          "id": "FluBot",
          "display_name": "FluBot",
          "target": null
        },
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "AZORult",
          "display_name": "AZORult",
          "target": null
        },
        {
          "id": "Djvu",
          "display_name": "Djvu",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Maze",
          "display_name": "Maze",
          "target": null
        },
        {
          "id": "Dark",
          "display_name": "Dark",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1065",
          "name": "Uncommonly Used Port",
          "display_name": "T1065 - Uncommonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65c96df8fe0657d56a206a49",
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 251,
        "FileHash-SHA1": 211,
        "FileHash-SHA256": 3226,
        "domain": 1867,
        "URL": 10030,
        "hostname": 2919,
        "CVE": 7,
        "email": 6
      },
      "indicator_count": 18517,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "257 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c96df8fe0657d56a206a49",
      "name": "Nokoyawa Ransomware - https://house.mo.gov/",
      "description": "Cyber attack including Pegasus found in https://house.mo.gov/\nThis Observed links: dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/Appears to attacking with heightened privilege escalation.\nLinks originated from https://safebae.org attack,  various Westlaw links and links attacking a private citizen. HallRender is malware hosting domain featuring an aggressive  'Brian Sabey' representing self as attorney protecting white collar individuals accused of SA is attacker. Boldly contacts victims via mail, email, phone, text, invites, personal invitations to office. \n\nFront facing https://safebae.org, a 'tribute' domain may mention alleged SA victim Daisy Coleman. Research confirms no mention of 'Daisy' safebae is filled with cyber bullying toolkit; ransomware.csv, tracking, westlaw, tagging tools, pornhub, rallypoint,  adult malvertizing content targeting a Colorado SA victim. \nIt's all very real but so unbelievable. Malware spreading, cyberthreat",
      "modified": "2024-03-13T00:02:54.335000",
      "created": "2024-02-12T01:01:44.323000",
      "tags": [
        "runtime process",
        "localappdata",
        "size",
        "sha256",
        "sha1",
        "temp",
        "prefetch8",
        "prefetch1",
        "unicode text",
        "type data",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "mitre",
        "writes a pe file header to disc",
        "show process",
        "date",
        "document file",
        "v2 document",
        "ascii text",
        "malicious",
        "local",
        "path",
        "found",
        "ssl certificate",
        "whois record",
        "threat roundup",
        "contacted",
        "october",
        "resolutions",
        "apple ios",
        "referrer",
        "communicating",
        "execution",
        "june",
        "august",
        "emotet",
        "qakbot",
        "agent tesla",
        "azorult",
        "core",
        "maze",
        "metro",
        "dark",
        "team",
        "critical",
        "copy",
        "awful",
        "ursnif",
        "hacktool",
        "info",
        "qbot",
        "april",
        "njrat",
        "nokoyawa",
        "djvu",
        "flubot",
        "ransomware",
        "bandit stealer",
        "hallrender",
        "spyware",
        "safebae",
        "tsara brashears",
        "westlaw",
        "river.rocks",
        "brian sabey",
        "targeting",
        "dnspionage",
        "united",
        "unknown",
        "search",
        "aaaa",
        "showing",
        "domain",
        "creation date",
        "record value",
        "dnssec",
        "body",
        "passive dns",
        "encrypt",
        "as14061",
        "germany unknown",
        "as397240",
        "gmt server",
        "443 ma2592000",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "main",
        "installing",
        "as16276",
        "france unknown",
        "name servers",
        "as8075",
        "servers",
        "next",
        "as63949 linode",
        "as206834 team",
        "canada unknown",
        "status",
        "as61969 team",
        "msie",
        "chrome",
        "ransom",
        "gone",
        "title",
        "head body",
        "malware"
      ],
      "references": [
        "\u2193\u2192Found in: https://house.mo.gov/\u2193",
        "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
        "demo.auth.civicalg.com.sni.cloudflaressl.com",
        "happyrabbit.kr [Apple iOS threat]",
        "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
        "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
        "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
        "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
        "http://nudeteenporn.site"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Nokoyawa Ransomware",
          "display_name": "Nokoyawa Ransomware",
          "target": null
        },
        {
          "id": "Bandit Stealer",
          "display_name": "Bandit Stealer",
          "target": null
        },
        {
          "id": "FluBot",
          "display_name": "FluBot",
          "target": null
        },
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "AZORult",
          "display_name": "AZORult",
          "target": null
        },
        {
          "id": "Djvu",
          "display_name": "Djvu",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Maze",
          "display_name": "Maze",
          "target": null
        },
        {
          "id": "Dark",
          "display_name": "Dark",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1065",
          "name": "Uncommonly Used Port",
          "display_name": "T1065 - Uncommonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 48,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 194,
        "FileHash-SHA1": 191,
        "FileHash-SHA256": 2376,
        "domain": 1414,
        "URL": 4388,
        "hostname": 1699,
        "CVE": 4,
        "email": 5
      },
      "indicator_count": 10271,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "767 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ml.tongyi13.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ml.tongyi13.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641672.356716
}