{
  "type": "URL",
  "indicator": "https://mott.appleid.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mott.appleid.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3787935487,
      "indicator": "https://mott.appleid.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 24,
      "pulses": [
        {
          "id": "69e4e7cfdc3bb3cdffeecf7c",
          "name": "[[[[RVA Entry | Apple remote unlocking| Emotet | Redline]]]  [clone by scoreblue]",
          "description": "",
          "modified": "2026-04-19T14:33:51.385000",
          "created": "2026-04-19T14:33:51.385000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "resolutions",
            "referrer",
            "communicating",
            "siblings",
            "file",
            "hell",
            "lenovo tablet",
            "name servers",
            "as714 apple",
            "united",
            "creation date",
            "search",
            "servers",
            "date",
            "moved",
            "certificate",
            "passive dns",
            "body",
            "historical",
            "collections",
            "contacted",
            "strange",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "blacklist http",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "malicious site",
            "malware site",
            "phishing site",
            "million",
            "malware",
            "http attacker",
            "ip address",
            "algorithm",
            "v3 serial",
            "number",
            "ist ca",
            "g1 validity",
            "public key",
            "info",
            "key algorithm",
            "ec oid",
            "key identifier",
            "first",
            "team alexa",
            "downloader",
            "wed apr",
            "alexa",
            "pony",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "script",
            "beginstring",
            "mitre att",
            "null",
            "unknown",
            "span",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "refresh",
            "tools",
            "malicious url",
            "hostname",
            "hostnames",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "spammer",
            "node tcp",
            "traffic",
            "attacker",
            "tor known",
            "tor relayrouter",
            "jul jan",
            "mon sep",
            "heur",
            "artemis",
            "iframe",
            "conduit",
            "crack",
            "riskware",
            "opencandy",
            "cleaner",
            "exploit",
            "downldr",
            "presenoker",
            "wacatac",
            "agent",
            "fusioncore",
            "applicunwnt",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "filetour",
            "generic",
            "patcher",
            "driverpack",
            "xtrat",
            "softcnapp",
            "cyber threat",
            "dns server",
            "http spammer",
            "host",
            "download",
            "asyncrat",
            "cobalt strike",
            "apple",
            "urls http",
            "368600",
            "320700",
            "dc1542721039132",
            "subdomains",
            "noname057",
            "tld count",
            "urls",
            "blacklist https",
            "engineering",
            "singapore",
            "phishtank",
            "suppobox",
            "bambernek",
            "facebook",
            "zbot",
            "malicious",
            "zeus",
            "emotet",
            "ransomware",
            "nymaim",
            "redline stealer",
            "service",
            "virut",
            "kraken",
            "keybase",
            "stealer",
            "hawkeye",
            "tinba",
            "mirai",
            "nanocore",
            "bradesco",
            "cve201711882",
            "ip detections",
            "country",
            "83500",
            "1602192580242",
            "1602192586217",
            "blog",
            "1602192588844",
            "1602192624796",
            "303300",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "win32 exe",
            "magic pe32",
            "ms windows",
            "intel",
            "trid windows",
            "control panel",
            "file version",
            "copyright",
            "product",
            "description",
            "original name",
            "internal name",
            "rticon neutral",
            "chi2",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "count blacklist",
            "tag tag",
            "dot net",
            "assembly common",
            "clr version",
            "assembly name",
            "address",
            "assembly",
            "rva entry",
            "streams size",
            "entropy chi2",
            "guid",
            "applenoc",
            "showing",
            "record value",
            "scan endpoints",
            "all search",
            "as20940",
            "as16625 akamai",
            "status",
            "cname",
            "china",
            "as136907 huawei",
            "nanjing",
            "as2914 ntt",
            "america",
            "as7843 charter",
            "as6461 zayo",
            "domain",
            "p155-fmfmobile.icloud.com",
            "t-mobile",
            "metro t-mobile",
            "metro",
            "metroby",
            "social engineering",
            "happywifehappylife",
            "bot",
            "darknet service",
            "tsara brashears",
            "jeffrey reimer",
            "pixelrz",
            "yandex",
            "cp",
            "cyber",
            "red team",
            "framing",
            "qwest",
            "cybercrime",
            "cyber threat",
            "sha256",
            "runtime process",
            "sha1",
            "size",
            "windows nt",
            "indicator",
            "svg scalable",
            "accept",
            "unis",
            "buttons",
            "overwrite",
            "format",
            "spyware",
            "heodo",
            "fri nov",
            "installcore",
            "installpack",
            "win64",
            "fakealert",
            "dropper",
            "fakeinstaller",
            "spyrixkeylogger",
            "bitminer",
            "loadmoney",
            "dapato",
            "networm",
            "mediaget",
            "softonic",
            "trojan",
            "encpk",
            "qbot",
            "predator",
            "kraddare",
            "iobit",
            "dllinject",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "unruy",
            "floxif",
            "adload",
            "et cins",
            "active threat",
            "reputation ip",
            "threats et",
            "cins active",
            "poor reputation",
            "ip tcp",
            "privacy admin",
            "privacy tech",
            "com laude",
            "redacted for",
            "server",
            "priority",
            "email",
            "organization",
            "city",
            "cnapple public",
            "server rsa",
            "stcalifornia",
            "cnapple ist",
            "identity search",
            "group",
            "issuer criteria",
            "type",
            "ilike search",
            "id logged",
            "valid",
            "no no",
            "no na",
            "ip security",
            "apple",
            "limited",
            "ca id",
            "lsalford",
            "ocomodo ca",
            "code signing",
            "mozilla",
            "android",
            "memory checks",
            "dotnet_encrypted",
            "multi family rat detection",
            "malware_win_zgrat"
          ],
          "references": [
            "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
            "p155-fmfmobile.icloud.com",
            "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
            "developer.huawei.com",
            "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
            "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
            "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
            "fmfmobile.fe.apple-dns.net",
            "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
            "http://notredamewormhoutnet.appleid.com/",
            "news-publisher.pictures",
            "applestore.net",
            "airinthemorning.net",
            "http://certs.apple.com/appleistca2g1_bc.cer",
            "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
            "https://dc-mx.d3525d602ca2.pixelrz.com",
            "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
            "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
            "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
            "http://pixelrz.com/lists/suggestions/rs485-arduino/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
            "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
            "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
            "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
            "Resource: https://crt.sh/?q=privaterelay.appleid.com",
            "\u2193Command and Control \u2193",
            "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
            "CNC Hostname:  urlspirit.spiritsoft.cn",
            "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
            "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
            "Resource: https://urlscan.io/domain/privaterelay.appleid.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Systweak",
              "display_name": "Systweak",
              "target": null
            },
            {
              "id": "Swrort",
              "display_name": "Swrort",
              "target": null
            },
            {
              "id": "Tinba",
              "display_name": "Tinba",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Tiggre",
              "display_name": "Tiggre",
              "target": null
            },
            {
              "id": "FusionCore",
              "display_name": "FusionCore",
              "target": null
            },
            {
              "id": "Redline",
              "display_name": "Redline",
              "target": null
            },
            {
              "id": "Virus:DOS/Nanjing",
              "display_name": "Virus:DOS/Nanjing",
              "target": "/malware/Virus:DOS/Nanjing"
            },
            {
              "id": "nircmd",
              "display_name": "nircmd",
              "target": null
            },
            {
              "id": "noname057",
              "display_name": "noname057",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Softcnapp",
              "display_name": "Softcnapp",
              "target": null
            },
            {
              "id": "Union",
              "display_name": "Union",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "Kraddare",
              "display_name": "Kraddare",
              "target": null
            },
            {
              "id": "Networm",
              "display_name": "Networm",
              "target": null
            },
            {
              "id": "trojan.agensla/msil",
              "display_name": "trojan.agensla/msil",
              "target": null
            },
            {
              "id": "Win:ZGRAT",
              "display_name": "Win:ZGRAT",
              "target": null
            },
            {
              "id": "Wacatac.",
              "display_name": "Wacatac.",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "656a971ab44409ecb7018428",
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1220,
            "FileHash-SHA1": 613,
            "FileHash-SHA256": 5010,
            "URL": 13617,
            "hostname": 3699,
            "domain": 2783,
            "email": 11,
            "CVE": 23,
            "CIDR": 2
          },
          "indicator_count": 26978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "3 hours ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69e4e7c6ddf646eb4e645bd5",
          "name": "[[[[RVA Entry | Apple remote unlocking| Emotet | Redline]]]  [clone by scoreblue]",
          "description": "",
          "modified": "2026-04-19T14:33:42.400000",
          "created": "2026-04-19T14:33:42.400000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "resolutions",
            "referrer",
            "communicating",
            "siblings",
            "file",
            "hell",
            "lenovo tablet",
            "name servers",
            "as714 apple",
            "united",
            "creation date",
            "search",
            "servers",
            "date",
            "moved",
            "certificate",
            "passive dns",
            "body",
            "historical",
            "collections",
            "contacted",
            "strange",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "blacklist http",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "malicious site",
            "malware site",
            "phishing site",
            "million",
            "malware",
            "http attacker",
            "ip address",
            "algorithm",
            "v3 serial",
            "number",
            "ist ca",
            "g1 validity",
            "public key",
            "info",
            "key algorithm",
            "ec oid",
            "key identifier",
            "first",
            "team alexa",
            "downloader",
            "wed apr",
            "alexa",
            "pony",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "script",
            "beginstring",
            "mitre att",
            "null",
            "unknown",
            "span",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "refresh",
            "tools",
            "malicious url",
            "hostname",
            "hostnames",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "spammer",
            "node tcp",
            "traffic",
            "attacker",
            "tor known",
            "tor relayrouter",
            "jul jan",
            "mon sep",
            "heur",
            "artemis",
            "iframe",
            "conduit",
            "crack",
            "riskware",
            "opencandy",
            "cleaner",
            "exploit",
            "downldr",
            "presenoker",
            "wacatac",
            "agent",
            "fusioncore",
            "applicunwnt",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "filetour",
            "generic",
            "patcher",
            "driverpack",
            "xtrat",
            "softcnapp",
            "cyber threat",
            "dns server",
            "http spammer",
            "host",
            "download",
            "asyncrat",
            "cobalt strike",
            "apple",
            "urls http",
            "368600",
            "320700",
            "dc1542721039132",
            "subdomains",
            "noname057",
            "tld count",
            "urls",
            "blacklist https",
            "engineering",
            "singapore",
            "phishtank",
            "suppobox",
            "bambernek",
            "facebook",
            "zbot",
            "malicious",
            "zeus",
            "emotet",
            "ransomware",
            "nymaim",
            "redline stealer",
            "service",
            "virut",
            "kraken",
            "keybase",
            "stealer",
            "hawkeye",
            "tinba",
            "mirai",
            "nanocore",
            "bradesco",
            "cve201711882",
            "ip detections",
            "country",
            "83500",
            "1602192580242",
            "1602192586217",
            "blog",
            "1602192588844",
            "1602192624796",
            "303300",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "win32 exe",
            "magic pe32",
            "ms windows",
            "intel",
            "trid windows",
            "control panel",
            "file version",
            "copyright",
            "product",
            "description",
            "original name",
            "internal name",
            "rticon neutral",
            "chi2",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "count blacklist",
            "tag tag",
            "dot net",
            "assembly common",
            "clr version",
            "assembly name",
            "address",
            "assembly",
            "rva entry",
            "streams size",
            "entropy chi2",
            "guid",
            "applenoc",
            "showing",
            "record value",
            "scan endpoints",
            "all search",
            "as20940",
            "as16625 akamai",
            "status",
            "cname",
            "china",
            "as136907 huawei",
            "nanjing",
            "as2914 ntt",
            "america",
            "as7843 charter",
            "as6461 zayo",
            "domain",
            "p155-fmfmobile.icloud.com",
            "t-mobile",
            "metro t-mobile",
            "metro",
            "metroby",
            "social engineering",
            "happywifehappylife",
            "bot",
            "darknet service",
            "tsara brashears",
            "jeffrey reimer",
            "pixelrz",
            "yandex",
            "cp",
            "cyber",
            "red team",
            "framing",
            "qwest",
            "cybercrime",
            "cyber threat",
            "sha256",
            "runtime process",
            "sha1",
            "size",
            "windows nt",
            "indicator",
            "svg scalable",
            "accept",
            "unis",
            "buttons",
            "overwrite",
            "format",
            "spyware",
            "heodo",
            "fri nov",
            "installcore",
            "installpack",
            "win64",
            "fakealert",
            "dropper",
            "fakeinstaller",
            "spyrixkeylogger",
            "bitminer",
            "loadmoney",
            "dapato",
            "networm",
            "mediaget",
            "softonic",
            "trojan",
            "encpk",
            "qbot",
            "predator",
            "kraddare",
            "iobit",
            "dllinject",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "unruy",
            "floxif",
            "adload",
            "et cins",
            "active threat",
            "reputation ip",
            "threats et",
            "cins active",
            "poor reputation",
            "ip tcp",
            "privacy admin",
            "privacy tech",
            "com laude",
            "redacted for",
            "server",
            "priority",
            "email",
            "organization",
            "city",
            "cnapple public",
            "server rsa",
            "stcalifornia",
            "cnapple ist",
            "identity search",
            "group",
            "issuer criteria",
            "type",
            "ilike search",
            "id logged",
            "valid",
            "no no",
            "no na",
            "ip security",
            "apple",
            "limited",
            "ca id",
            "lsalford",
            "ocomodo ca",
            "code signing",
            "mozilla",
            "android",
            "memory checks",
            "dotnet_encrypted",
            "multi family rat detection",
            "malware_win_zgrat"
          ],
          "references": [
            "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
            "p155-fmfmobile.icloud.com",
            "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
            "developer.huawei.com",
            "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
            "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
            "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
            "fmfmobile.fe.apple-dns.net",
            "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
            "http://notredamewormhoutnet.appleid.com/",
            "news-publisher.pictures",
            "applestore.net",
            "airinthemorning.net",
            "http://certs.apple.com/appleistca2g1_bc.cer",
            "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
            "https://dc-mx.d3525d602ca2.pixelrz.com",
            "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
            "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
            "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
            "http://pixelrz.com/lists/suggestions/rs485-arduino/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
            "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
            "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
            "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
            "Resource: https://crt.sh/?q=privaterelay.appleid.com",
            "\u2193Command and Control \u2193",
            "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
            "CNC Hostname:  urlspirit.spiritsoft.cn",
            "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
            "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
            "Resource: https://urlscan.io/domain/privaterelay.appleid.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Systweak",
              "display_name": "Systweak",
              "target": null
            },
            {
              "id": "Swrort",
              "display_name": "Swrort",
              "target": null
            },
            {
              "id": "Tinba",
              "display_name": "Tinba",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Tiggre",
              "display_name": "Tiggre",
              "target": null
            },
            {
              "id": "FusionCore",
              "display_name": "FusionCore",
              "target": null
            },
            {
              "id": "Redline",
              "display_name": "Redline",
              "target": null
            },
            {
              "id": "Virus:DOS/Nanjing",
              "display_name": "Virus:DOS/Nanjing",
              "target": "/malware/Virus:DOS/Nanjing"
            },
            {
              "id": "nircmd",
              "display_name": "nircmd",
              "target": null
            },
            {
              "id": "noname057",
              "display_name": "noname057",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Softcnapp",
              "display_name": "Softcnapp",
              "target": null
            },
            {
              "id": "Union",
              "display_name": "Union",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "Kraddare",
              "display_name": "Kraddare",
              "target": null
            },
            {
              "id": "Networm",
              "display_name": "Networm",
              "target": null
            },
            {
              "id": "trojan.agensla/msil",
              "display_name": "trojan.agensla/msil",
              "target": null
            },
            {
              "id": "Win:ZGRAT",
              "display_name": "Win:ZGRAT",
              "target": null
            },
            {
              "id": "Wacatac.",
              "display_name": "Wacatac.",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "656a971ab44409ecb7018428",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1220,
            "FileHash-SHA1": 613,
            "FileHash-SHA256": 5010,
            "URL": 13617,
            "hostname": 3699,
            "domain": 2783,
            "email": 11,
            "CVE": 23,
            "CIDR": 2
          },
          "indicator_count": 26978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "3 hours ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d68fffbf012630d57033b6",
          "name": "Sabey SWIPPER - Pornhub\u00bbX.Com migration to Twitter | Sabey\u2019s Daddy Data Center ",
          "description": "",
          "modified": "2026-04-08T17:27:27.851000",
          "created": "2026-04-08T17:27:27.851000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69bea426487bffa5384c6f38",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "11 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bea426487bffa5384c6f38",
          "name": " Brian Sabey illegally deleting IoC\u2019s | SWIPPER - Pornhub\u00bbX.Com migration to Twitter Sabey Erasing",
          "description": "",
          "modified": "2026-03-21T13:59:02.016000",
          "created": "2026-03-21T13:59:02.016000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "29 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68888ed9c3a537ac4491eba7",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration [scoreblue]",
          "description": "",
          "modified": "2025-07-29T09:05:29.205000",
          "created": "2025-07-29T09:05:29.205000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "264 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d4916fa7338286448118a1",
          "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com migration to Twitter ",
          "description": "",
          "modified": "2024-10-19T18:02:34.237000",
          "created": "2024-09-01T16:08:15.260000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ccbd92f716bb0ca0fda93d",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 935,
            "URL": 5882,
            "domain": 571,
            "hostname": 1418,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 9054,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "546 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "670268310c19cecfd0fdce4b",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey - Pornhub Campaigns X.Com",
          "description": "",
          "modified": "2024-10-06T10:36:33.718000",
          "created": "2024-10-06T10:36:33.718000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "560 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66eb08c239be3721ab6c9050",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration to Twitter",
          "description": "",
          "modified": "2024-10-06T10:30:32.632000",
          "created": "2024-09-18T17:07:14.432000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66d4916fa7338286448118a1",
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "560 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c66b55663b96406b28c28c",
          "name": "x.com - Porn Smear | Brian Sabey | Sabey Data Centers & Swipp-a-dee-doo-dah ",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-21T22:33:57.501000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66c5db8e996dcef20be8a618",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ccbd92f716bb0ca0fda93d",
          "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com - allows redirection for member abuse of Crime Victim",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-26T17:38:26.472000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ca36c85ccdb4c97c164228",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66cc6dd98fdbf12d67404091",
          "name": "2",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-26T11:58:17.321000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66c5db8e996dcef20be8a618",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Krishivpatel",
            "id": "292085",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 26,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ca36c85ccdb4c97c164228",
          "name": ".com - Porn Smear | Brian Sabey | Sabey Data Centers & Swipp9",
          "description": "",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-24T19:38:48.399000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66c66b55663b96406b28c28c",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c5db8e996dcef20be8a618",
          "name": "x.com - Ridiculous Porn Smear | Brian Sabey | Sabey Data Centers | Thebrotherssabey | Hallrender.com",
          "description": "It's a crazy I have to post this way. OTX has a stealer in it that I haven't found. It is attacking accounts and removing incriminating posts. Brian Sabey has been hired to destroy reputations, privacy, peace and everything he is doing is illegal.  Most PI/s and law firms have this 'attorney resource' in their arsenal. In the state of Colorado; you don't even need a license to be a private investigator. The target I've been researching for has been approached by all kinds of PI's. Addicts, some telling what they were doing, defunct veterans. I'm not making fun of veterans, it should be considered that besides seizures, veterans with untreatable PTSD are being used to push cannabis, hallucinogenics, ketamine for treatment. Imagine having one of those guys approach you for drugs then remember they are stalking/watching your every move. This isn't an investigation. This is abuse",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-21T12:20:30.851000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c5db8bbc7d57514ddcc757",
          "name": "x.com - Ridiculous Porn Smear | Brian Sabey | Sabey Data Centers | Thebrotherssabey | Hallrender.com",
          "description": "It's a crazy I have to post this way. OTX has a stealer in it that I haven't found. It is attacking accounts and removing incriminating posts. Brian Sabey has been hired to destroy reputations, privacy, peace and everything he is doing is illegal.  Most PI/s and law firms have this 'attorney resource' in their arsenal. In the state of Colorado; you don't even need a license to be a private investigator. The target I've been researching for has been approached by all kinds of PI's. Addicts, some telling what they were doing, defunct veterans. I'm not making fun of veterans, it should be considered that besides seizures, veterans with untreatable PTSD are being used to push cannabis, hallucinogenics, ketamine for treatment. Imagine having one of those guys approach you for drugs then remember they are stalking/watching your every move. This isn't an investigation. This is abuse",
          "modified": "2024-09-20T03:00:51.533000",
          "created": "2024-08-21T12:20:27.469000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 303,
            "URL": 906,
            "domain": 258,
            "hostname": 308,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66507a6eb3fde0552a6ebd9d",
          "name": "Sweet QuaDreams Apple | Hostile Spy campaign | Service modifier (Updated) ",
          "description": "",
          "modified": "2024-06-23T10:00:24.005000",
          "created": "2024-05-24T11:30:54.138000",
          "tags": [
            "technology",
            "apple computer",
            "dns replication",
            "date",
            "domain",
            "lookups",
            "city",
            "apple abuse",
            "orgid",
            "rtechhandle",
            "june",
            "threat roundup",
            "triad",
            "usps",
            "us citizens",
            "data theft",
            "august",
            "apple",
            "sweet quadreams",
            "spyware vendor",
            "get http",
            "png image",
            "rgba",
            "ms windows",
            "united",
            "intel",
            "windows nt",
            "as16509",
            "pe32",
            "crlf line",
            "win32",
            "write",
            "next",
            "artemis",
            "malware",
            "copy",
            "cname",
            "unknown",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "urls",
            "pagewritecopy",
            "pageexecuteread",
            "nx00xffxe2",
            "nx00xc7d",
            "memcommit",
            "pagenoaccess",
            "memreserve",
            "service",
            "high process",
            "injection t1055"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6650751b8dd6c7d00f0d7478",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1524,
            "CIDR": 1,
            "URL": 5189,
            "email": 2,
            "hostname": 867,
            "FileHash-MD5": 117,
            "FileHash-SHA1": 27,
            "domain": 403
          },
          "indicator_count": 8130,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "665 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6650751b8dd6c7d00f0d7478",
          "name": "ET INFO Terse | Apple | Win.Trojan.Zbot-6598057-0",
          "description": "Tags, results generated by Level Blue OTX. AlienVault\nMy limited research results: \nApple | CIDR\n17.0.0.0/8\nFileHash-SHA256 d9ff17dd19a01ad64a77df6837e566319d16a235ac7223b9f565f470e57154c8 | Antivirus Detections\nWin32:Dropper-gen, Adware.Xadupi.B, Mirai, Win.Trojan.Zbot-6598057-0,\na variant of Win32/ELEX.IE potentially unwanted, Adware.Xadupi.B, Artemis!69E9EFD2E75E\nIDS Detections:\nET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile.\nYara Detections: dbgdetect_funcs,\nAlerts: injection_runpe,\nnetwork_icmp,\nallocates_execute_remote_process,\npersistence_autorun,\ncreates_service,\ninjection_modifies_memory,\ninjection_write_memory,\nprocess_martian,\nransomware_extensions,\nransomware_mass_file_delete",
          "modified": "2024-06-23T10:00:24.005000",
          "created": "2024-05-24T11:08:10.044000",
          "tags": [
            "technology",
            "apple computer",
            "dns replication",
            "date",
            "domain",
            "lookups",
            "city",
            "apple abuse",
            "orgid",
            "rtechhandle",
            "june",
            "threat roundup",
            "triad",
            "usps",
            "us citizens",
            "data theft",
            "august",
            "apple",
            "sweet quadreams",
            "spyware vendor",
            "get http",
            "png image",
            "rgba",
            "ms windows",
            "united",
            "intel",
            "windows nt",
            "as16509",
            "pe32",
            "crlf line",
            "win32",
            "write",
            "next",
            "artemis",
            "malware",
            "copy",
            "cname",
            "unknown",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "urls",
            "pagewritecopy",
            "pageexecuteread",
            "nx00xffxe2",
            "nx00xc7d",
            "memcommit",
            "pagenoaccess",
            "memreserve",
            "service",
            "high process",
            "injection t1055"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1524,
            "CIDR": 1,
            "URL": 5189,
            "email": 2,
            "hostname": 867,
            "FileHash-MD5": 117,
            "FileHash-SHA1": 27,
            "domain": 403
          },
          "indicator_count": 8130,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "665 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b806e2724db65b47cf66e0",
          "name": "AiCloud - Comcast Dnspionage",
          "description": "",
          "modified": "2024-02-27T19:04:14.842000",
          "created": "2024-01-29T20:13:22.271000",
          "tags": [
            "prefetch8",
            "command decode",
            "prefetch1",
            "suricata ipv4",
            "suricata udpv4",
            "mitre att",
            "united",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "passive dns",
            "as7922 comcast",
            "x ua",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "meta",
            "status",
            "creation date",
            "search",
            "record value",
            "expiration date",
            "name servers",
            "next",
            "ai cloud",
            "cname",
            "as7018 att",
            "win32",
            "entries",
            "unknown",
            "body",
            "no redirect",
            "dynamicloader",
            "msie",
            "windows nt",
            "as16509",
            "medium",
            "default",
            "show",
            "copy",
            "powershell",
            "write",
            "pegasus",
            "apple mobile",
            "content",
            "nso group",
            "apple web",
            "apple app capable",
            "typosquatting",
            "spyware",
            "epoch"
          ],
          "references": [
            "c-67-181-73-197.hsd1.ca.comcast.net",
            "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259",
            "identity_helper.exe"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "AndroidOverlayMalware - MOB-S0012",
              "display_name": "AndroidOverlayMalware - MOB-S0012",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b6b54d59d24b1522364fd6",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 522,
            "URL": 1194,
            "domain": 440,
            "FileHash-SHA256": 1528,
            "CVE": 1,
            "email": 2,
            "FileHash-MD5": 297,
            "FileHash-SHA1": 297
          },
          "indicator_count": 4281,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b6b54d59d24b1522364fd6",
          "name": "AiCloud - Comcast Dnspionage",
          "description": "AiCloud, a cloud-based app that connects to Apple and Google, has been compromised by a malicious virus.",
          "modified": "2024-02-27T19:04:14.842000",
          "created": "2024-01-28T20:13:01.311000",
          "tags": [
            "prefetch8",
            "command decode",
            "prefetch1",
            "suricata ipv4",
            "suricata udpv4",
            "mitre att",
            "united",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "passive dns",
            "as7922 comcast",
            "x ua",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "meta",
            "status",
            "creation date",
            "search",
            "record value",
            "expiration date",
            "name servers",
            "next",
            "ai cloud",
            "cname",
            "as7018 att",
            "win32",
            "entries",
            "unknown",
            "body",
            "no redirect",
            "dynamicloader",
            "msie",
            "windows nt",
            "as16509",
            "medium",
            "default",
            "show",
            "copy",
            "powershell",
            "write",
            "pegasus",
            "apple mobile",
            "content",
            "nso group",
            "apple web",
            "apple app capable",
            "typosquatting",
            "spyware",
            "epoch"
          ],
          "references": [
            "c-67-181-73-197.hsd1.ca.comcast.net",
            "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259",
            "identity_helper.exe"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "AndroidOverlayMalware - MOB-S0012",
              "display_name": "AndroidOverlayMalware - MOB-S0012",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 522,
            "URL": 1194,
            "domain": 440,
            "FileHash-SHA256": 1528,
            "CVE": 1,
            "email": 2,
            "FileHash-MD5": 297,
            "FileHash-SHA1": 297
          },
          "indicator_count": 4281,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659d15c13f838593a01984b6",
          "name": "Project Hilo",
          "description": "",
          "modified": "2024-02-08T09:05:26.319000",
          "created": "2024-01-09T09:45:37.584000",
          "tags": [
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "search",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "pulse pulses",
            "date",
            "next",
            "showing",
            "files",
            "files ip",
            "whois record",
            "ssl certificate",
            "historical ssl",
            "resolutions",
            "whois whois",
            "siblings",
            "trojan bank",
            "m referrer",
            "subdomains",
            "execution",
            "dropped",
            "whois",
            "bank",
            "parent siblings",
            "referrer",
            "as8075",
            "united",
            "nxdomain",
            "united kingdom",
            "south korea",
            "unknown",
            "mascore2",
            "nct1",
            "arc1",
            "ems1",
            "localeenus",
            "htd1",
            "lang1033",
            "devlangen"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 536,
            "email": 3,
            "hostname": 1486,
            "URL": 2496,
            "FileHash-SHA256": 784,
            "FileHash-MD5": 27,
            "FileHash-SHA1": 13
          },
          "indicator_count": 5345,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "801 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659261e2290ac1ecc5d9ca74",
          "name": "Pegasus - a-poster.info",
          "description": "",
          "modified": "2024-01-31T04:00:35.757000",
          "created": "2024-01-01T06:55:30.771000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "ipv4",
            "expiration",
            "iocs",
            "ipv6",
            "url http",
            "url https",
            "next",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "cidr",
            "pcap",
            "stix",
            "subid",
            "mtsub26293293",
            "dashboard",
            "browse scan",
            "endpoints all",
            "octoseek",
            "a poster",
            "apple",
            "apple id",
            "apple engineering",
            "icloud",
            "tulach",
            "hallrender",
            "ck matrix",
            "ck id",
            "xobo",
            "a nxdomain",
            "sabey",
            "aaaa",
            "win32",
            "briansabey",
            "brian",
            "brian sabey",
            "urls https",
            "unknown urls",
            "united",
            "ttl value",
            "tsara brashears",
            "trojan",
            "tracker",
            "tofsee",
            "threat analyzer",
            "threat",
            "temp",
            "teams api",
            "subdomains",
            "active",
            "active threat",
            "strings",
            "status codes",
            "japan national police agency",
            "pegasus",
            "china",
            "aig",
            "ssl certificate",
            "accept",
            "ssh on server",
            "speakez securus",
            "show technique",
            "https",
            "relay",
            "state",
            "android",
            "address",
            "aposter",
            "workaposter",
            "sha256",
            "showing",
            "simple",
            "span",
            "small",
            "serving ip",
            "script",
            "search",
            "root",
            "ca",
            "samples",
            "root ca",
            "resolutions",
            "remote",
            "relay",
            "relacion",
            "referrer",
            "record value",
            "applenoc",
            "as16625",
            "attack",
            "apple attack",
            "bundled",
            "canvas",
            "mitre attk",
            "brute force passwords",
            "body length",
            "body",
            "backdoor",
            "bellsouth",
            "bahamut",
            "bell south",
            "mitre",
            "cellbrite",
            "class",
            "click",
            "authority",
            "contentencoding",
            "akamai",
            "as20940",
            "as24940 hetzner",
            "as58061 scalaxy",
            "scalaxy",
            "as714",
            "critical",
            "communicating",
            "quasar",
            "trojan",
            "et",
            "icefog",
            "pegasus",
            "tofsee",
            "cmd",
            "crypto",
            "error",
            "dns replication",
            "domain entries",
            "et cins",
            "execution",
            "cname",
            "config",
            "contact",
            "contacted",
            "copy",
            "creation date",
            "formbook",
            "jekyll",
            "graph",
            "germany unknown",
            "generator",
            "general",
            "forbidden",
            "falcon sandbox",
            "ssl hostname",
            "false",
            "file",
            "final url",
            "final url summary",
            "hashes files",
            "headers nel",
            "historical",
            "malicious host",
            "malvertizing",
            "malware",
            "tagging",
            "contextualizing",
            "localappdata",
            "install",
            "installer",
            "ioc search",
            "iocs kb",
            "body",
            "local",
            "United states",
            "name",
            "name servers",
            "mitre att",
            "metro",
            "meta",
            "mail spammer",
            "submit",
            "submit quasar",
            "phishing",
            "pattern match",
            "paste",
            "passive dns",
            "nxdomain",
            "national police agency japan",
            "network",
            "verdict",
            "cmd",
            "sandbox",
            "http response",
            "record type",
            "phishing",
            "nuance",
            "next",
            "new ioc",
            "subdomains",
            "germany",
            "reinsurance",
            "nuance",
            "cybercrime",
            "tracking",
            "cyber stalking",
            "fear",
            "masquerading",
            "cobalt strike"
          ],
          "references": [
            "a-poster.info",
            "https://tulach.cc/",
            "images.ctfassets.net",
            "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
            "nr-data.net [Apple Private Data Collection]",
            "http://gmpg.org/xfn/11 [HTTrack]",
            "192.229.211.108 [Tracking & Virus Network]",
            "me.com [Pegasus]",
            "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
            "37.1.217.172 [scanning host]",
            "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Appleservice",
              "display_name": "Appleservice",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4695,
            "domain": 2494,
            "hostname": 3547,
            "FileHash-MD5": 4118,
            "FileHash-SHA1": 3496,
            "FileHash-SHA256": 5841,
            "CIDR": 12,
            "email": 17
          },
          "indicator_count": 24220,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659261d5965b4824d1606cf9",
          "name": "Pegasus - a-poster.info",
          "description": "",
          "modified": "2024-01-31T04:00:35.757000",
          "created": "2024-01-01T06:55:17.262000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "ipv4",
            "expiration",
            "iocs",
            "ipv6",
            "url http",
            "url https",
            "next",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "cidr",
            "pcap",
            "stix",
            "subid",
            "mtsub26293293",
            "dashboard",
            "browse scan",
            "endpoints all",
            "octoseek",
            "a poster",
            "apple",
            "apple id",
            "apple engineering",
            "icloud",
            "tulach",
            "hallrender",
            "ck matrix",
            "ck id",
            "xobo",
            "a nxdomain",
            "sabey",
            "aaaa",
            "win32",
            "briansabey",
            "brian",
            "brian sabey",
            "urls https",
            "unknown urls",
            "united",
            "ttl value",
            "tsara brashears",
            "trojan",
            "tracker",
            "tofsee",
            "threat analyzer",
            "threat",
            "temp",
            "teams api",
            "subdomains",
            "active",
            "active threat",
            "strings",
            "status codes",
            "japan national police agency",
            "pegasus",
            "china",
            "aig",
            "ssl certificate",
            "accept",
            "ssh on server",
            "speakez securus",
            "show technique",
            "https",
            "relay",
            "state",
            "android",
            "address",
            "aposter",
            "workaposter",
            "sha256",
            "showing",
            "simple",
            "span",
            "small",
            "serving ip",
            "script",
            "search",
            "root",
            "ca",
            "samples",
            "root ca",
            "resolutions",
            "remote",
            "relay",
            "relacion",
            "referrer",
            "record value",
            "applenoc",
            "as16625",
            "attack",
            "apple attack",
            "bundled",
            "canvas",
            "mitre attk",
            "brute force passwords",
            "body length",
            "body",
            "backdoor",
            "bellsouth",
            "bahamut",
            "bell south",
            "mitre",
            "cellbrite",
            "class",
            "click",
            "authority",
            "contentencoding",
            "akamai",
            "as20940",
            "as24940 hetzner",
            "as58061 scalaxy",
            "scalaxy",
            "as714",
            "critical",
            "communicating",
            "quasar",
            "trojan",
            "et",
            "icefog",
            "pegasus",
            "tofsee",
            "cmd",
            "crypto",
            "error",
            "dns replication",
            "domain entries",
            "et cins",
            "execution",
            "cname",
            "config",
            "contact",
            "contacted",
            "copy",
            "creation date",
            "formbook",
            "jekyll",
            "graph",
            "germany unknown",
            "generator",
            "general",
            "forbidden",
            "falcon sandbox",
            "ssl hostname",
            "false",
            "file",
            "final url",
            "final url summary",
            "hashes files",
            "headers nel",
            "historical",
            "malicious host",
            "malvertizing",
            "malware",
            "tagging",
            "contextualizing",
            "localappdata",
            "install",
            "installer",
            "ioc search",
            "iocs kb",
            "body",
            "local",
            "United states",
            "name",
            "name servers",
            "mitre att",
            "metro",
            "meta",
            "mail spammer",
            "submit",
            "submit quasar",
            "phishing",
            "pattern match",
            "paste",
            "passive dns",
            "nxdomain",
            "national police agency japan",
            "network",
            "verdict",
            "cmd",
            "sandbox",
            "http response",
            "record type",
            "phishing",
            "nuance",
            "next",
            "new ioc",
            "subdomains",
            "germany",
            "reinsurance",
            "nuance",
            "cybercrime",
            "tracking",
            "cyber stalking",
            "fear",
            "masquerading",
            "cobalt strike"
          ],
          "references": [
            "a-poster.info",
            "https://tulach.cc/",
            "images.ctfassets.net",
            "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
            "nr-data.net [Apple Private Data Collection]",
            "http://gmpg.org/xfn/11 [HTTrack]",
            "192.229.211.108 [Tracking & Virus Network]",
            "me.com [Pegasus]",
            "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
            "37.1.217.172 [scanning host]",
            "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Appleservice",
              "display_name": "Appleservice",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4719,
            "domain": 2497,
            "hostname": 3549,
            "FileHash-MD5": 4118,
            "FileHash-SHA1": 3496,
            "FileHash-SHA256": 5861,
            "CIDR": 12,
            "email": 17
          },
          "indicator_count": 24269,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6569984495dfed1b14e29217",
          "name": "RVA Entry | Apple remote unlocking| Emotet | Redline |  | Injection",
          "description": "Active iCloud monitoring by third party. Active cyber threat.\nFound in link on iOS device: p155-fmfmobile.icloud.com\nFraud services. No data, service, or legitimate carrier",
          "modified": "2023-12-30T14:02:30.516000",
          "created": "2023-12-01T08:24:36.293000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "resolutions",
            "referrer",
            "communicating",
            "siblings",
            "file",
            "hell",
            "lenovo tablet",
            "name servers",
            "as714 apple",
            "united",
            "creation date",
            "search",
            "servers",
            "date",
            "moved",
            "certificate",
            "passive dns",
            "body",
            "historical",
            "collections",
            "contacted",
            "strange",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "blacklist http",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "malicious site",
            "malware site",
            "phishing site",
            "million",
            "malware",
            "http attacker",
            "ip address",
            "algorithm",
            "v3 serial",
            "number",
            "ist ca",
            "g1 validity",
            "public key",
            "info",
            "key algorithm",
            "ec oid",
            "key identifier",
            "first",
            "team alexa",
            "downloader",
            "wed apr",
            "alexa",
            "pony",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "script",
            "beginstring",
            "mitre att",
            "null",
            "unknown",
            "span",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "refresh",
            "tools",
            "malicious url",
            "hostname",
            "hostnames",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "spammer",
            "node tcp",
            "traffic",
            "attacker",
            "tor known",
            "tor relayrouter",
            "jul jan",
            "mon sep",
            "heur",
            "artemis",
            "iframe",
            "conduit",
            "crack",
            "riskware",
            "opencandy",
            "cleaner",
            "exploit",
            "downldr",
            "presenoker",
            "wacatac",
            "agent",
            "fusioncore",
            "applicunwnt",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "filetour",
            "generic",
            "patcher",
            "driverpack",
            "xtrat",
            "softcnapp",
            "cyber threat",
            "dns server",
            "http spammer",
            "host",
            "download",
            "asyncrat",
            "cobalt strike",
            "apple",
            "urls http",
            "368600",
            "320700",
            "dc1542721039132",
            "subdomains",
            "noname057",
            "tld count",
            "urls",
            "blacklist https",
            "engineering",
            "singapore",
            "phishtank",
            "suppobox",
            "bambernek",
            "facebook",
            "zbot",
            "malicious",
            "zeus",
            "emotet",
            "ransomware",
            "nymaim",
            "redline stealer",
            "service",
            "virut",
            "kraken",
            "keybase",
            "stealer",
            "hawkeye",
            "tinba",
            "mirai",
            "nanocore",
            "bradesco",
            "cve201711882",
            "ip detections",
            "country",
            "83500",
            "1602192580242",
            "1602192586217",
            "blog",
            "1602192588844",
            "1602192624796",
            "303300",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "win32 exe",
            "magic pe32",
            "ms windows",
            "intel",
            "trid windows",
            "control panel",
            "file version",
            "copyright",
            "product",
            "description",
            "original name",
            "internal name",
            "rticon neutral",
            "chi2",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "count blacklist",
            "tag tag",
            "dot net",
            "assembly common",
            "clr version",
            "assembly name",
            "address",
            "assembly",
            "rva entry",
            "streams size",
            "entropy chi2",
            "guid",
            "applenoc",
            "showing",
            "record value",
            "scan endpoints",
            "all search",
            "as20940",
            "as16625 akamai",
            "status",
            "cname",
            "china",
            "as136907 huawei",
            "nanjing",
            "as2914 ntt",
            "america",
            "as7843 charter",
            "as6461 zayo",
            "domain",
            "p155-fmfmobile.icloud.com",
            "t-mobile",
            "metro t-mobile",
            "metro",
            "metroby",
            "social engineering",
            "happywifehappylife",
            "bot",
            "darknet service",
            "tsara brashears",
            "jeffrey reimer",
            "pixelrz",
            "yandex",
            "cp",
            "cyber",
            "red team",
            "framing",
            "qwest",
            "cybercrime",
            "cyber threat",
            "sha256",
            "runtime process",
            "sha1",
            "size",
            "windows nt",
            "indicator",
            "svg scalable",
            "accept",
            "unis",
            "buttons",
            "overwrite",
            "format",
            "spyware",
            "heodo",
            "fri nov",
            "installcore",
            "installpack",
            "win64",
            "fakealert",
            "dropper",
            "fakeinstaller",
            "spyrixkeylogger",
            "bitminer",
            "loadmoney",
            "dapato",
            "networm",
            "mediaget",
            "softonic",
            "trojan",
            "encpk",
            "qbot",
            "predator",
            "kraddare",
            "iobit",
            "dllinject",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "unruy",
            "floxif",
            "adload",
            "et cins",
            "active threat",
            "reputation ip",
            "threats et",
            "cins active",
            "poor reputation",
            "ip tcp",
            "privacy admin",
            "privacy tech",
            "com laude",
            "redacted for",
            "server",
            "priority",
            "email",
            "organization",
            "city",
            "cnapple public",
            "server rsa",
            "stcalifornia",
            "cnapple ist",
            "identity search",
            "group",
            "issuer criteria",
            "type",
            "ilike search",
            "id logged",
            "valid",
            "no no",
            "no na",
            "ip security",
            "apple",
            "limited",
            "ca id",
            "lsalford",
            "ocomodo ca",
            "code signing",
            "mozilla",
            "android",
            "memory checks",
            "dotnet_encrypted",
            "multi family rat detection",
            "malware_win_zgrat"
          ],
          "references": [
            "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
            "p155-fmfmobile.icloud.com",
            "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
            "developer.huawei.com",
            "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
            "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
            "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
            "fmfmobile.fe.apple-dns.net",
            "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
            "http://notredamewormhoutnet.appleid.com/",
            "news-publisher.pictures",
            "applestore.net",
            "airinthemorning.net",
            "http://certs.apple.com/appleistca2g1_bc.cer",
            "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
            "https://dc-mx.d3525d602ca2.pixelrz.com",
            "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
            "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
            "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
            "http://pixelrz.com/lists/suggestions/rs485-arduino/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
            "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
            "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
            "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
            "Resource: https://crt.sh/?q=privaterelay.appleid.com",
            "\u2193Command and Control \u2193",
            "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
            "CNC Hostname:  urlspirit.spiritsoft.cn",
            "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
            "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
            "Resource: https://urlscan.io/domain/privaterelay.appleid.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Systweak",
              "display_name": "Systweak",
              "target": null
            },
            {
              "id": "Swrort",
              "display_name": "Swrort",
              "target": null
            },
            {
              "id": "Tinba",
              "display_name": "Tinba",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Tiggre",
              "display_name": "Tiggre",
              "target": null
            },
            {
              "id": "FusionCore",
              "display_name": "FusionCore",
              "target": null
            },
            {
              "id": "Redline",
              "display_name": "Redline",
              "target": null
            },
            {
              "id": "Virus:DOS/Nanjing",
              "display_name": "Virus:DOS/Nanjing",
              "target": "/malware/Virus:DOS/Nanjing"
            },
            {
              "id": "nircmd",
              "display_name": "nircmd",
              "target": null
            },
            {
              "id": "noname057",
              "display_name": "noname057",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Softcnapp",
              "display_name": "Softcnapp",
              "target": null
            },
            {
              "id": "Union",
              "display_name": "Union",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "Kraddare",
              "display_name": "Kraddare",
              "target": null
            },
            {
              "id": "Networm",
              "display_name": "Networm",
              "target": null
            },
            {
              "id": "trojan.agensla/msil",
              "display_name": "trojan.agensla/msil",
              "target": null
            },
            {
              "id": "Win:ZGRAT",
              "display_name": "Win:ZGRAT",
              "target": null
            },
            {
              "id": "Wacatac.",
              "display_name": "Wacatac.",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1220,
            "FileHash-SHA1": 613,
            "FileHash-SHA256": 5010,
            "URL": 13617,
            "hostname": 3699,
            "domain": 2783,
            "email": 11,
            "CVE": 23,
            "CIDR": 2
          },
          "indicator_count": 26978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "841 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a971ab44409ecb7018428",
          "name": "RVA Entry | Apple remote unlocking| Emotet | Redline | | Injection",
          "description": "",
          "modified": "2023-12-30T14:02:30.516000",
          "created": "2023-12-02T02:31:54.823000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "resolutions",
            "referrer",
            "communicating",
            "siblings",
            "file",
            "hell",
            "lenovo tablet",
            "name servers",
            "as714 apple",
            "united",
            "creation date",
            "search",
            "servers",
            "date",
            "moved",
            "certificate",
            "passive dns",
            "body",
            "historical",
            "collections",
            "contacted",
            "strange",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "blacklist http",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "malicious site",
            "malware site",
            "phishing site",
            "million",
            "malware",
            "http attacker",
            "ip address",
            "algorithm",
            "v3 serial",
            "number",
            "ist ca",
            "g1 validity",
            "public key",
            "info",
            "key algorithm",
            "ec oid",
            "key identifier",
            "first",
            "team alexa",
            "downloader",
            "wed apr",
            "alexa",
            "pony",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "script",
            "beginstring",
            "mitre att",
            "null",
            "unknown",
            "span",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "refresh",
            "tools",
            "malicious url",
            "hostname",
            "hostnames",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "spammer",
            "node tcp",
            "traffic",
            "attacker",
            "tor known",
            "tor relayrouter",
            "jul jan",
            "mon sep",
            "heur",
            "artemis",
            "iframe",
            "conduit",
            "crack",
            "riskware",
            "opencandy",
            "cleaner",
            "exploit",
            "downldr",
            "presenoker",
            "wacatac",
            "agent",
            "fusioncore",
            "applicunwnt",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "filetour",
            "generic",
            "patcher",
            "driverpack",
            "xtrat",
            "softcnapp",
            "cyber threat",
            "dns server",
            "http spammer",
            "host",
            "download",
            "asyncrat",
            "cobalt strike",
            "apple",
            "urls http",
            "368600",
            "320700",
            "dc1542721039132",
            "subdomains",
            "noname057",
            "tld count",
            "urls",
            "blacklist https",
            "engineering",
            "singapore",
            "phishtank",
            "suppobox",
            "bambernek",
            "facebook",
            "zbot",
            "malicious",
            "zeus",
            "emotet",
            "ransomware",
            "nymaim",
            "redline stealer",
            "service",
            "virut",
            "kraken",
            "keybase",
            "stealer",
            "hawkeye",
            "tinba",
            "mirai",
            "nanocore",
            "bradesco",
            "cve201711882",
            "ip detections",
            "country",
            "83500",
            "1602192580242",
            "1602192586217",
            "blog",
            "1602192588844",
            "1602192624796",
            "303300",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "win32 exe",
            "magic pe32",
            "ms windows",
            "intel",
            "trid windows",
            "control panel",
            "file version",
            "copyright",
            "product",
            "description",
            "original name",
            "internal name",
            "rticon neutral",
            "chi2",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "count blacklist",
            "tag tag",
            "dot net",
            "assembly common",
            "clr version",
            "assembly name",
            "address",
            "assembly",
            "rva entry",
            "streams size",
            "entropy chi2",
            "guid",
            "applenoc",
            "showing",
            "record value",
            "scan endpoints",
            "all search",
            "as20940",
            "as16625 akamai",
            "status",
            "cname",
            "china",
            "as136907 huawei",
            "nanjing",
            "as2914 ntt",
            "america",
            "as7843 charter",
            "as6461 zayo",
            "domain",
            "p155-fmfmobile.icloud.com",
            "t-mobile",
            "metro t-mobile",
            "metro",
            "metroby",
            "social engineering",
            "happywifehappylife",
            "bot",
            "darknet service",
            "tsara brashears",
            "jeffrey reimer",
            "pixelrz",
            "yandex",
            "cp",
            "cyber",
            "red team",
            "framing",
            "qwest",
            "cybercrime",
            "cyber threat",
            "sha256",
            "runtime process",
            "sha1",
            "size",
            "windows nt",
            "indicator",
            "svg scalable",
            "accept",
            "unis",
            "buttons",
            "overwrite",
            "format",
            "spyware",
            "heodo",
            "fri nov",
            "installcore",
            "installpack",
            "win64",
            "fakealert",
            "dropper",
            "fakeinstaller",
            "spyrixkeylogger",
            "bitminer",
            "loadmoney",
            "dapato",
            "networm",
            "mediaget",
            "softonic",
            "trojan",
            "encpk",
            "qbot",
            "predator",
            "kraddare",
            "iobit",
            "dllinject",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "unruy",
            "floxif",
            "adload",
            "et cins",
            "active threat",
            "reputation ip",
            "threats et",
            "cins active",
            "poor reputation",
            "ip tcp",
            "privacy admin",
            "privacy tech",
            "com laude",
            "redacted for",
            "server",
            "priority",
            "email",
            "organization",
            "city",
            "cnapple public",
            "server rsa",
            "stcalifornia",
            "cnapple ist",
            "identity search",
            "group",
            "issuer criteria",
            "type",
            "ilike search",
            "id logged",
            "valid",
            "no no",
            "no na",
            "ip security",
            "apple",
            "limited",
            "ca id",
            "lsalford",
            "ocomodo ca",
            "code signing",
            "mozilla",
            "android",
            "memory checks",
            "dotnet_encrypted",
            "multi family rat detection",
            "malware_win_zgrat"
          ],
          "references": [
            "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
            "p155-fmfmobile.icloud.com",
            "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
            "developer.huawei.com",
            "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
            "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
            "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
            "fmfmobile.fe.apple-dns.net",
            "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
            "http://notredamewormhoutnet.appleid.com/",
            "news-publisher.pictures",
            "applestore.net",
            "airinthemorning.net",
            "http://certs.apple.com/appleistca2g1_bc.cer",
            "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
            "https://dc-mx.d3525d602ca2.pixelrz.com",
            "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
            "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
            "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
            "http://pixelrz.com/lists/suggestions/rs485-arduino/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
            "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
            "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
            "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
            "Resource: https://crt.sh/?q=privaterelay.appleid.com",
            "\u2193Command and Control \u2193",
            "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
            "CNC Hostname:  urlspirit.spiritsoft.cn",
            "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
            "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
            "Resource: https://urlscan.io/domain/privaterelay.appleid.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Systweak",
              "display_name": "Systweak",
              "target": null
            },
            {
              "id": "Swrort",
              "display_name": "Swrort",
              "target": null
            },
            {
              "id": "Tinba",
              "display_name": "Tinba",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Tiggre",
              "display_name": "Tiggre",
              "target": null
            },
            {
              "id": "FusionCore",
              "display_name": "FusionCore",
              "target": null
            },
            {
              "id": "Redline",
              "display_name": "Redline",
              "target": null
            },
            {
              "id": "Virus:DOS/Nanjing",
              "display_name": "Virus:DOS/Nanjing",
              "target": "/malware/Virus:DOS/Nanjing"
            },
            {
              "id": "nircmd",
              "display_name": "nircmd",
              "target": null
            },
            {
              "id": "noname057",
              "display_name": "noname057",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Softcnapp",
              "display_name": "Softcnapp",
              "target": null
            },
            {
              "id": "Union",
              "display_name": "Union",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "Kraddare",
              "display_name": "Kraddare",
              "target": null
            },
            {
              "id": "Networm",
              "display_name": "Networm",
              "target": null
            },
            {
              "id": "trojan.agensla/msil",
              "display_name": "trojan.agensla/msil",
              "target": null
            },
            {
              "id": "Win:ZGRAT",
              "display_name": "Win:ZGRAT",
              "target": null
            },
            {
              "id": "Wacatac.",
              "display_name": "Wacatac.",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6569984495dfed1b14e29217",
          "export_count": 68,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1220,
            "FileHash-SHA1": 613,
            "FileHash-SHA256": 5010,
            "URL": 13617,
            "hostname": 3699,
            "domain": 2783,
            "email": 11,
            "CVE": 23,
            "CIDR": 2
          },
          "indicator_count": 26978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "841 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a9718ac97804d782cc16b",
          "name": "RVA Entry | Apple remote unlocking| Emotet | Redline | | Injection",
          "description": "",
          "modified": "2023-12-30T14:02:30.516000",
          "created": "2023-12-02T02:31:52.614000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "resolutions",
            "referrer",
            "communicating",
            "siblings",
            "file",
            "hell",
            "lenovo tablet",
            "name servers",
            "as714 apple",
            "united",
            "creation date",
            "search",
            "servers",
            "date",
            "moved",
            "certificate",
            "passive dns",
            "body",
            "historical",
            "collections",
            "contacted",
            "strange",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "blacklist http",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "malicious site",
            "malware site",
            "phishing site",
            "million",
            "malware",
            "http attacker",
            "ip address",
            "algorithm",
            "v3 serial",
            "number",
            "ist ca",
            "g1 validity",
            "public key",
            "info",
            "key algorithm",
            "ec oid",
            "key identifier",
            "first",
            "team alexa",
            "downloader",
            "wed apr",
            "alexa",
            "pony",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "script",
            "beginstring",
            "mitre att",
            "null",
            "unknown",
            "span",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "refresh",
            "tools",
            "malicious url",
            "hostname",
            "hostnames",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "spammer",
            "node tcp",
            "traffic",
            "attacker",
            "tor known",
            "tor relayrouter",
            "jul jan",
            "mon sep",
            "heur",
            "artemis",
            "iframe",
            "conduit",
            "crack",
            "riskware",
            "opencandy",
            "cleaner",
            "exploit",
            "downldr",
            "presenoker",
            "wacatac",
            "agent",
            "fusioncore",
            "applicunwnt",
            "acint",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "filetour",
            "generic",
            "patcher",
            "driverpack",
            "xtrat",
            "softcnapp",
            "cyber threat",
            "dns server",
            "http spammer",
            "host",
            "download",
            "asyncrat",
            "cobalt strike",
            "apple",
            "urls http",
            "368600",
            "320700",
            "dc1542721039132",
            "subdomains",
            "noname057",
            "tld count",
            "urls",
            "blacklist https",
            "engineering",
            "singapore",
            "phishtank",
            "suppobox",
            "bambernek",
            "facebook",
            "zbot",
            "malicious",
            "zeus",
            "emotet",
            "ransomware",
            "nymaim",
            "redline stealer",
            "service",
            "virut",
            "kraken",
            "keybase",
            "stealer",
            "hawkeye",
            "tinba",
            "mirai",
            "nanocore",
            "bradesco",
            "cve201711882",
            "ip detections",
            "country",
            "83500",
            "1602192580242",
            "1602192586217",
            "blog",
            "1602192588844",
            "1602192624796",
            "303300",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "win32 exe",
            "magic pe32",
            "ms windows",
            "intel",
            "trid windows",
            "control panel",
            "file version",
            "copyright",
            "product",
            "description",
            "original name",
            "internal name",
            "rticon neutral",
            "chi2",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "count blacklist",
            "tag tag",
            "dot net",
            "assembly common",
            "clr version",
            "assembly name",
            "address",
            "assembly",
            "rva entry",
            "streams size",
            "entropy chi2",
            "guid",
            "applenoc",
            "showing",
            "record value",
            "scan endpoints",
            "all search",
            "as20940",
            "as16625 akamai",
            "status",
            "cname",
            "china",
            "as136907 huawei",
            "nanjing",
            "as2914 ntt",
            "america",
            "as7843 charter",
            "as6461 zayo",
            "domain",
            "p155-fmfmobile.icloud.com",
            "t-mobile",
            "metro t-mobile",
            "metro",
            "metroby",
            "social engineering",
            "happywifehappylife",
            "bot",
            "darknet service",
            "tsara brashears",
            "jeffrey reimer",
            "pixelrz",
            "yandex",
            "cp",
            "cyber",
            "red team",
            "framing",
            "qwest",
            "cybercrime",
            "cyber threat",
            "sha256",
            "runtime process",
            "sha1",
            "size",
            "windows nt",
            "indicator",
            "svg scalable",
            "accept",
            "unis",
            "buttons",
            "overwrite",
            "format",
            "spyware",
            "heodo",
            "fri nov",
            "installcore",
            "installpack",
            "win64",
            "fakealert",
            "dropper",
            "fakeinstaller",
            "spyrixkeylogger",
            "bitminer",
            "loadmoney",
            "dapato",
            "networm",
            "mediaget",
            "softonic",
            "trojan",
            "encpk",
            "qbot",
            "predator",
            "kraddare",
            "iobit",
            "dllinject",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "unruy",
            "floxif",
            "adload",
            "et cins",
            "active threat",
            "reputation ip",
            "threats et",
            "cins active",
            "poor reputation",
            "ip tcp",
            "privacy admin",
            "privacy tech",
            "com laude",
            "redacted for",
            "server",
            "priority",
            "email",
            "organization",
            "city",
            "cnapple public",
            "server rsa",
            "stcalifornia",
            "cnapple ist",
            "identity search",
            "group",
            "issuer criteria",
            "type",
            "ilike search",
            "id logged",
            "valid",
            "no no",
            "no na",
            "ip security",
            "apple",
            "limited",
            "ca id",
            "lsalford",
            "ocomodo ca",
            "code signing",
            "mozilla",
            "android",
            "memory checks",
            "dotnet_encrypted",
            "multi family rat detection",
            "malware_win_zgrat"
          ],
          "references": [
            "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
            "p155-fmfmobile.icloud.com",
            "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
            "developer.huawei.com",
            "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
            "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
            "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
            "fmfmobile.fe.apple-dns.net",
            "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
            "http://notredamewormhoutnet.appleid.com/",
            "news-publisher.pictures",
            "applestore.net",
            "airinthemorning.net",
            "http://certs.apple.com/appleistca2g1_bc.cer",
            "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
            "https://dc-mx.d3525d602ca2.pixelrz.com",
            "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
            "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
            "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
            "http://pixelrz.com/lists/suggestions/rs485-arduino/",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
            "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
            "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
            "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
            "Resource: https://crt.sh/?q=privaterelay.appleid.com",
            "\u2193Command and Control \u2193",
            "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
            "CNC Hostname:  urlspirit.spiritsoft.cn",
            "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
            "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
            "Resource: https://urlscan.io/domain/privaterelay.appleid.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Systweak",
              "display_name": "Systweak",
              "target": null
            },
            {
              "id": "Swrort",
              "display_name": "Swrort",
              "target": null
            },
            {
              "id": "Tinba",
              "display_name": "Tinba",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Tiggre",
              "display_name": "Tiggre",
              "target": null
            },
            {
              "id": "FusionCore",
              "display_name": "FusionCore",
              "target": null
            },
            {
              "id": "Redline",
              "display_name": "Redline",
              "target": null
            },
            {
              "id": "Virus:DOS/Nanjing",
              "display_name": "Virus:DOS/Nanjing",
              "target": "/malware/Virus:DOS/Nanjing"
            },
            {
              "id": "nircmd",
              "display_name": "nircmd",
              "target": null
            },
            {
              "id": "noname057",
              "display_name": "noname057",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Softcnapp",
              "display_name": "Softcnapp",
              "target": null
            },
            {
              "id": "Union",
              "display_name": "Union",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "Kraddare",
              "display_name": "Kraddare",
              "target": null
            },
            {
              "id": "Networm",
              "display_name": "Networm",
              "target": null
            },
            {
              "id": "trojan.agensla/msil",
              "display_name": "trojan.agensla/msil",
              "target": null
            },
            {
              "id": "Win:ZGRAT",
              "display_name": "Win:ZGRAT",
              "target": null
            },
            {
              "id": "Wacatac.",
              "display_name": "Wacatac.",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6569984495dfed1b14e29217",
          "export_count": 67,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1220,
            "FileHash-SHA1": 613,
            "FileHash-SHA256": 5010,
            "URL": 13617,
            "hostname": 3699,
            "domain": 2783,
            "email": 11,
            "CVE": 23,
            "CIDR": 2
          },
          "indicator_count": 26978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "841 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "nr-data.net [Apple Private Data Collection]",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "images.ctfassets.net",
        "fmfmobile.fe.apple-dns.net",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
        "Resource: https://crt.sh/?q=privaterelay.appleid.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
        "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259",
        "me.com [Pegasus]",
        "developer.huawei.com",
        "https://tulach.cc/",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "\u2193Command and Control \u2193",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
        "http://notredamewormhoutnet.appleid.com/",
        "CNC Hostname:  urlspirit.spiritsoft.cn",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "identity_helper.exe",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "airinthemorning.net",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "a-poster.info",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://certs.apple.com/appleistca2g1_bc.cer",
        "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
        "applestore.net",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "Resource: https://urlscan.io/domain/privaterelay.appleid.com",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
        "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
        "p155-fmfmobile.icloud.com",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://dc-mx.d3525d602ca2.pixelrz.com",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
        "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "37.1.217.172 [scanning host]",
        "news-publisher.pictures",
        "http://pixelrz.com/lists/suggestions/rs485-arduino/",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
        "192.229.211.108 [Tracking & Virus Network]",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://gmpg.org/xfn/11 [HTTrack]",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "c-67-181-73-197.hsd1.ca.comcast.net",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Brian Sabey | Tulach | Sabey Data Centers"
          ],
          "malware_families": [
            "Bambernek",
            "Win32/tofsee.ax",
            "Sabey",
            "Pegasus",
            "Androidoverlaymalware - mob-s0012",
            "Networm",
            "Suppobox",
            "Cobalt strike",
            "Softcnapp",
            "Win:zgrat",
            "Quasar rat",
            "Emotet",
            "Noname057",
            "Tofsee",
            "Pegasus - mob-s0005",
            "Tiggre",
            "Union",
            "Swrort",
            "Trojan.agensla/msil",
            "Hallrender",
            "Trojan",
            "Zbot",
            "Blacknet",
            "Wacatac.",
            "Systweak",
            "Nircmd",
            "Fusioncore",
            "Tulach",
            "Virus:dos/nanjing",
            "Trojan:win32/muldrop",
            "Trojandownloader:win32/cutwail",
            "Zeus",
            "Tinba",
            "Redline",
            "Icefog",
            "Pegasus for android - mob-s0032",
            "Pegasus for ios - s0289",
            "Xrat",
            "Kraddare",
            "Formbook",
            "Appleservice"
          ],
          "industries": [
            "Healthcare"
          ],
          "unique_indicators": 70405
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/appleid.com",
    "whois": "http://whois.domaintools.com/appleid.com",
    "domain": "appleid.com",
    "hostname": "mott.appleid.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 24,
  "pulses": [
    {
      "id": "69e4e7cfdc3bb3cdffeecf7c",
      "name": "[[[[RVA Entry | Apple remote unlocking| Emotet | Redline]]]  [clone by scoreblue]",
      "description": "",
      "modified": "2026-04-19T14:33:51.385000",
      "created": "2026-04-19T14:33:51.385000",
      "tags": [
        "ssl certificate",
        "whois record",
        "historical ssl",
        "resolutions",
        "referrer",
        "communicating",
        "siblings",
        "file",
        "hell",
        "lenovo tablet",
        "name servers",
        "as714 apple",
        "united",
        "creation date",
        "search",
        "servers",
        "date",
        "moved",
        "certificate",
        "passive dns",
        "body",
        "historical",
        "collections",
        "contacted",
        "strange",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "blacklist http",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "malicious site",
        "malware site",
        "phishing site",
        "million",
        "malware",
        "http attacker",
        "ip address",
        "algorithm",
        "v3 serial",
        "number",
        "ist ca",
        "g1 validity",
        "public key",
        "info",
        "key algorithm",
        "ec oid",
        "key identifier",
        "first",
        "team alexa",
        "downloader",
        "wed apr",
        "alexa",
        "pony",
        "name verdict",
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "script",
        "beginstring",
        "mitre att",
        "null",
        "unknown",
        "span",
        "error",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "refresh",
        "tools",
        "malicious url",
        "hostname",
        "hostnames",
        "phishing",
        "union",
        "team",
        "bank",
        "unsafe",
        "spammer",
        "node tcp",
        "traffic",
        "attacker",
        "tor known",
        "tor relayrouter",
        "jul jan",
        "mon sep",
        "heur",
        "artemis",
        "iframe",
        "conduit",
        "crack",
        "riskware",
        "opencandy",
        "cleaner",
        "exploit",
        "downldr",
        "presenoker",
        "wacatac",
        "agent",
        "fusioncore",
        "applicunwnt",
        "acint",
        "nircmd",
        "swrort",
        "systweak",
        "behav",
        "tiggre",
        "genkryptik",
        "filetour",
        "generic",
        "patcher",
        "driverpack",
        "xtrat",
        "softcnapp",
        "cyber threat",
        "dns server",
        "http spammer",
        "host",
        "download",
        "asyncrat",
        "cobalt strike",
        "apple",
        "urls http",
        "368600",
        "320700",
        "dc1542721039132",
        "subdomains",
        "noname057",
        "tld count",
        "urls",
        "blacklist https",
        "engineering",
        "singapore",
        "phishtank",
        "suppobox",
        "bambernek",
        "facebook",
        "zbot",
        "malicious",
        "zeus",
        "emotet",
        "ransomware",
        "nymaim",
        "redline stealer",
        "service",
        "virut",
        "kraken",
        "keybase",
        "stealer",
        "hawkeye",
        "tinba",
        "mirai",
        "nanocore",
        "bradesco",
        "cve201711882",
        "ip detections",
        "country",
        "83500",
        "1602192580242",
        "1602192586217",
        "blog",
        "1602192588844",
        "1602192624796",
        "303300",
        "vhash",
        "authentihash",
        "ssdeep",
        "file type",
        "win32 exe",
        "magic pe32",
        "ms windows",
        "intel",
        "trid windows",
        "control panel",
        "file version",
        "copyright",
        "product",
        "description",
        "original name",
        "internal name",
        "rticon neutral",
        "chi2",
        "contained",
        "details module",
        "version id",
        "typelib id",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "count blacklist",
        "tag tag",
        "dot net",
        "assembly common",
        "clr version",
        "assembly name",
        "address",
        "assembly",
        "rva entry",
        "streams size",
        "entropy chi2",
        "guid",
        "applenoc",
        "showing",
        "record value",
        "scan endpoints",
        "all search",
        "as20940",
        "as16625 akamai",
        "status",
        "cname",
        "china",
        "as136907 huawei",
        "nanjing",
        "as2914 ntt",
        "america",
        "as7843 charter",
        "as6461 zayo",
        "domain",
        "p155-fmfmobile.icloud.com",
        "t-mobile",
        "metro t-mobile",
        "metro",
        "metroby",
        "social engineering",
        "happywifehappylife",
        "bot",
        "darknet service",
        "tsara brashears",
        "jeffrey reimer",
        "pixelrz",
        "yandex",
        "cp",
        "cyber",
        "red team",
        "framing",
        "qwest",
        "cybercrime",
        "cyber threat",
        "sha256",
        "runtime process",
        "sha1",
        "size",
        "windows nt",
        "indicator",
        "svg scalable",
        "accept",
        "unis",
        "buttons",
        "overwrite",
        "format",
        "spyware",
        "heodo",
        "fri nov",
        "installcore",
        "installpack",
        "win64",
        "fakealert",
        "dropper",
        "fakeinstaller",
        "spyrixkeylogger",
        "bitminer",
        "loadmoney",
        "dapato",
        "networm",
        "mediaget",
        "softonic",
        "trojan",
        "encpk",
        "qbot",
        "predator",
        "kraddare",
        "iobit",
        "dllinject",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "unruy",
        "floxif",
        "adload",
        "et cins",
        "active threat",
        "reputation ip",
        "threats et",
        "cins active",
        "poor reputation",
        "ip tcp",
        "privacy admin",
        "privacy tech",
        "com laude",
        "redacted for",
        "server",
        "priority",
        "email",
        "organization",
        "city",
        "cnapple public",
        "server rsa",
        "stcalifornia",
        "cnapple ist",
        "identity search",
        "group",
        "issuer criteria",
        "type",
        "ilike search",
        "id logged",
        "valid",
        "no no",
        "no na",
        "ip security",
        "apple",
        "limited",
        "ca id",
        "lsalford",
        "ocomodo ca",
        "code signing",
        "mozilla",
        "android",
        "memory checks",
        "dotnet_encrypted",
        "multi family rat detection",
        "malware_win_zgrat"
      ],
      "references": [
        "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
        "p155-fmfmobile.icloud.com",
        "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
        "developer.huawei.com",
        "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
        "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
        "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
        "fmfmobile.fe.apple-dns.net",
        "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
        "http://notredamewormhoutnet.appleid.com/",
        "news-publisher.pictures",
        "applestore.net",
        "airinthemorning.net",
        "http://certs.apple.com/appleistca2g1_bc.cer",
        "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
        "https://dc-mx.d3525d602ca2.pixelrz.com",
        "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
        "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
        "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
        "http://pixelrz.com/lists/suggestions/rs485-arduino/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
        "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
        "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
        "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
        "Resource: https://crt.sh/?q=privaterelay.appleid.com",
        "\u2193Command and Control \u2193",
        "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
        "CNC Hostname:  urlspirit.spiritsoft.cn",
        "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
        "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
        "Resource: https://urlscan.io/domain/privaterelay.appleid.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Systweak",
          "display_name": "Systweak",
          "target": null
        },
        {
          "id": "Swrort",
          "display_name": "Swrort",
          "target": null
        },
        {
          "id": "Tinba",
          "display_name": "Tinba",
          "target": null
        },
        {
          "id": "XRat",
          "display_name": "XRat",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        },
        {
          "id": "Tiggre",
          "display_name": "Tiggre",
          "target": null
        },
        {
          "id": "FusionCore",
          "display_name": "FusionCore",
          "target": null
        },
        {
          "id": "Redline",
          "display_name": "Redline",
          "target": null
        },
        {
          "id": "Virus:DOS/Nanjing",
          "display_name": "Virus:DOS/Nanjing",
          "target": "/malware/Virus:DOS/Nanjing"
        },
        {
          "id": "nircmd",
          "display_name": "nircmd",
          "target": null
        },
        {
          "id": "noname057",
          "display_name": "noname057",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "Softcnapp",
          "display_name": "Softcnapp",
          "target": null
        },
        {
          "id": "Union",
          "display_name": "Union",
          "target": null
        },
        {
          "id": "Bambernek",
          "display_name": "Bambernek",
          "target": null
        },
        {
          "id": "Kraddare",
          "display_name": "Kraddare",
          "target": null
        },
        {
          "id": "Networm",
          "display_name": "Networm",
          "target": null
        },
        {
          "id": "trojan.agensla/msil",
          "display_name": "trojan.agensla/msil",
          "target": null
        },
        {
          "id": "Win:ZGRAT",
          "display_name": "Win:ZGRAT",
          "target": null
        },
        {
          "id": "Wacatac.",
          "display_name": "Wacatac.",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1016",
          "name": "System Network Configuration Discovery",
          "display_name": "T1016 - System Network Configuration Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "656a971ab44409ecb7018428",
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1220,
        "FileHash-SHA1": 613,
        "FileHash-SHA256": 5010,
        "URL": 13617,
        "hostname": 3699,
        "domain": 2783,
        "email": 11,
        "CVE": 23,
        "CIDR": 2
      },
      "indicator_count": 26978,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "3 hours ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69e4e7c6ddf646eb4e645bd5",
      "name": "[[[[RVA Entry | Apple remote unlocking| Emotet | Redline]]]  [clone by scoreblue]",
      "description": "",
      "modified": "2026-04-19T14:33:42.400000",
      "created": "2026-04-19T14:33:42.400000",
      "tags": [
        "ssl certificate",
        "whois record",
        "historical ssl",
        "resolutions",
        "referrer",
        "communicating",
        "siblings",
        "file",
        "hell",
        "lenovo tablet",
        "name servers",
        "as714 apple",
        "united",
        "creation date",
        "search",
        "servers",
        "date",
        "moved",
        "certificate",
        "passive dns",
        "body",
        "historical",
        "collections",
        "contacted",
        "strange",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "blacklist http",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "malicious site",
        "malware site",
        "phishing site",
        "million",
        "malware",
        "http attacker",
        "ip address",
        "algorithm",
        "v3 serial",
        "number",
        "ist ca",
        "g1 validity",
        "public key",
        "info",
        "key algorithm",
        "ec oid",
        "key identifier",
        "first",
        "team alexa",
        "downloader",
        "wed apr",
        "alexa",
        "pony",
        "name verdict",
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "script",
        "beginstring",
        "mitre att",
        "null",
        "unknown",
        "span",
        "error",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "refresh",
        "tools",
        "malicious url",
        "hostname",
        "hostnames",
        "phishing",
        "union",
        "team",
        "bank",
        "unsafe",
        "spammer",
        "node tcp",
        "traffic",
        "attacker",
        "tor known",
        "tor relayrouter",
        "jul jan",
        "mon sep",
        "heur",
        "artemis",
        "iframe",
        "conduit",
        "crack",
        "riskware",
        "opencandy",
        "cleaner",
        "exploit",
        "downldr",
        "presenoker",
        "wacatac",
        "agent",
        "fusioncore",
        "applicunwnt",
        "acint",
        "nircmd",
        "swrort",
        "systweak",
        "behav",
        "tiggre",
        "genkryptik",
        "filetour",
        "generic",
        "patcher",
        "driverpack",
        "xtrat",
        "softcnapp",
        "cyber threat",
        "dns server",
        "http spammer",
        "host",
        "download",
        "asyncrat",
        "cobalt strike",
        "apple",
        "urls http",
        "368600",
        "320700",
        "dc1542721039132",
        "subdomains",
        "noname057",
        "tld count",
        "urls",
        "blacklist https",
        "engineering",
        "singapore",
        "phishtank",
        "suppobox",
        "bambernek",
        "facebook",
        "zbot",
        "malicious",
        "zeus",
        "emotet",
        "ransomware",
        "nymaim",
        "redline stealer",
        "service",
        "virut",
        "kraken",
        "keybase",
        "stealer",
        "hawkeye",
        "tinba",
        "mirai",
        "nanocore",
        "bradesco",
        "cve201711882",
        "ip detections",
        "country",
        "83500",
        "1602192580242",
        "1602192586217",
        "blog",
        "1602192588844",
        "1602192624796",
        "303300",
        "vhash",
        "authentihash",
        "ssdeep",
        "file type",
        "win32 exe",
        "magic pe32",
        "ms windows",
        "intel",
        "trid windows",
        "control panel",
        "file version",
        "copyright",
        "product",
        "description",
        "original name",
        "internal name",
        "rticon neutral",
        "chi2",
        "contained",
        "details module",
        "version id",
        "typelib id",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "count blacklist",
        "tag tag",
        "dot net",
        "assembly common",
        "clr version",
        "assembly name",
        "address",
        "assembly",
        "rva entry",
        "streams size",
        "entropy chi2",
        "guid",
        "applenoc",
        "showing",
        "record value",
        "scan endpoints",
        "all search",
        "as20940",
        "as16625 akamai",
        "status",
        "cname",
        "china",
        "as136907 huawei",
        "nanjing",
        "as2914 ntt",
        "america",
        "as7843 charter",
        "as6461 zayo",
        "domain",
        "p155-fmfmobile.icloud.com",
        "t-mobile",
        "metro t-mobile",
        "metro",
        "metroby",
        "social engineering",
        "happywifehappylife",
        "bot",
        "darknet service",
        "tsara brashears",
        "jeffrey reimer",
        "pixelrz",
        "yandex",
        "cp",
        "cyber",
        "red team",
        "framing",
        "qwest",
        "cybercrime",
        "cyber threat",
        "sha256",
        "runtime process",
        "sha1",
        "size",
        "windows nt",
        "indicator",
        "svg scalable",
        "accept",
        "unis",
        "buttons",
        "overwrite",
        "format",
        "spyware",
        "heodo",
        "fri nov",
        "installcore",
        "installpack",
        "win64",
        "fakealert",
        "dropper",
        "fakeinstaller",
        "spyrixkeylogger",
        "bitminer",
        "loadmoney",
        "dapato",
        "networm",
        "mediaget",
        "softonic",
        "trojan",
        "encpk",
        "qbot",
        "predator",
        "kraddare",
        "iobit",
        "dllinject",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "unruy",
        "floxif",
        "adload",
        "et cins",
        "active threat",
        "reputation ip",
        "threats et",
        "cins active",
        "poor reputation",
        "ip tcp",
        "privacy admin",
        "privacy tech",
        "com laude",
        "redacted for",
        "server",
        "priority",
        "email",
        "organization",
        "city",
        "cnapple public",
        "server rsa",
        "stcalifornia",
        "cnapple ist",
        "identity search",
        "group",
        "issuer criteria",
        "type",
        "ilike search",
        "id logged",
        "valid",
        "no no",
        "no na",
        "ip security",
        "apple",
        "limited",
        "ca id",
        "lsalford",
        "ocomodo ca",
        "code signing",
        "mozilla",
        "android",
        "memory checks",
        "dotnet_encrypted",
        "multi family rat detection",
        "malware_win_zgrat"
      ],
      "references": [
        "Resource: https://www.hybrid-analysis.com/sample/a1f40ad80f0a9e0dab543bcbbc70b4b7a941fbf8cd781ff52cd902bd7fe68cf7",
        "p155-fmfmobile.icloud.com",
        "\u2193Everything listed below found in link 'p155-fmfmobile.icloud.com'  monitoring targeted apple device\u2193",
        "developer.huawei.com",
        "PostBot.exe [0092864768862a870598a5f2e3f0052aaf3745cb57e71d3a4df5ac3a053059928591]",
        "http://www.cscglobal.com/global/web/csc/digital-brand-services.html",
        "Resource: https://www.hybrid-analysis.com/sample/0163a8787d958fed0d776ff72770cb40a146db528953b9da20a9f8d448171272/63169b4320a3f45a09183e45",
        "fmfmobile.fe.apple-dns.net",
        "http://news_at_info_iscanner_com_v72qynxzp9_3d157e86@privaterelay.appleid.com/",
        "http://notredamewormhoutnet.appleid.com/",
        "news-publisher.pictures",
        "applestore.net",
        "airinthemorning.net",
        "http://certs.apple.com/appleistca2g1_bc.cer",
        "http://pixelrz.com/list] (Yandex and Baidu spider, illegal content scraper)",
        "https://dc-mx.d3525d602ca2.pixelrz.com",
        "http://www.mobilevpn.download/files/ntn/nt1x.html?&model=iPhone&browser=Mobile%20Safari&city=Baltimore&brand=Apple&isp=The%20Johns%20Hopkins%20Medical%20Institutions&ip=162.129.252.228&td=xentracking.com&uclick=j246fny90&uclickhash=j246fny90-j246fny90-he7v-0-sca0-7vj20-7voc6o-cad73c",
        "http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/Accept-Language:",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead    (unconfirmed death)",
        "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/    (unconfirmed crime)",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/   (confirmed transactional agreement)",
        "http://pixelrz.com/lists/suggestions/rs485-arduino/",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception/  ( badgering. libel)",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  (open records act: confirmed assault report with injuries. Unconfirmed police investigation)",
        "http://hidden-camera-public-nudity.tubesporno.com  (Found in link 'p155-fmfmobile.icloud.com' on Apple device)",
        "http://info_at_twitter_com_rrrdxjyct7_5e128c93@privaterelay.appleid.com",
        "Resource: https://www.hybrid-analysis.com/sample/eb4b220c2393f8c04d5ec911a958c479a5dd920c6e9a323fed596e5c8483d9eb/65689de21b67ec5fc7086f84",
        "Resource: https://crt.sh/?q=privaterelay.appleid.com",
        "\u2193Command and Control \u2193",
        "CNC IPv4:  107.6.74.76 \u2022 110.42.64.224 \u2022 147.75.61.38 \u2022 147.75.63.87 \u2022 150.95.255.38 \u2022 162.255.119.250 \u2022 173.231.184.124 \u2022 173.231.189.15 \u2022 39.103.219.62 \u2022 52.241.88.36",
        "CNC Hostname:  urlspirit.spiritsoft.cn",
        "Malware IPv4: 17.167.144.79\u2022 \u2022 17.167.144.79 \u2022 17.167.146.83 \u2022 17.248.131.138 \u2022 17.248.139.74 \u2022 17.248.145.169 \u2022 17.248.241.114 \u2022  52.85.90.62 12/29/23 \u2022 104.27.146.207 \u2022 3.209.222.16",
        "Malware: Hostname browser.events.data.msn.com \u2022 Domain icloud.com.cn \u2022 Domain dropbox.com \u2022 Hostname privaterelay.appleid.com",
        "Resource: https://urlscan.io/domain/privaterelay.appleid.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Systweak",
          "display_name": "Systweak",
          "target": null
        },
        {
          "id": "Swrort",
          "display_name": "Swrort",
          "target": null
        },
        {
          "id": "Tinba",
          "display_name": "Tinba",
          "target": null
        },
        {
          "id": "XRat",
          "display_name": "XRat",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        },
        {
          "id": "Tiggre",
          "display_name": "Tiggre",
          "target": null
        },
        {
          "id": "FusionCore",
          "display_name": "FusionCore",
          "target": null
        },
        {
          "id": "Redline",
          "display_name": "Redline",
          "target": null
        },
        {
          "id": "Virus:DOS/Nanjing",
          "display_name": "Virus:DOS/Nanjing",
          "target": "/malware/Virus:DOS/Nanjing"
        },
        {
          "id": "nircmd",
          "display_name": "nircmd",
          "target": null
        },
        {
          "id": "noname057",
          "display_name": "noname057",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "Softcnapp",
          "display_name": "Softcnapp",
          "target": null
        },
        {
          "id": "Union",
          "display_name": "Union",
          "target": null
        },
        {
          "id": "Bambernek",
          "display_name": "Bambernek",
          "target": null
        },
        {
          "id": "Kraddare",
          "display_name": "Kraddare",
          "target": null
        },
        {
          "id": "Networm",
          "display_name": "Networm",
          "target": null
        },
        {
          "id": "trojan.agensla/msil",
          "display_name": "trojan.agensla/msil",
          "target": null
        },
        {
          "id": "Win:ZGRAT",
          "display_name": "Win:ZGRAT",
          "target": null
        },
        {
          "id": "Wacatac.",
          "display_name": "Wacatac.",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1016",
          "name": "System Network Configuration Discovery",
          "display_name": "T1016 - System Network Configuration Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "656a971ab44409ecb7018428",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1220,
        "FileHash-SHA1": 613,
        "FileHash-SHA256": 5010,
        "URL": 13617,
        "hostname": 3699,
        "domain": 2783,
        "email": 11,
        "CVE": 23,
        "CIDR": 2
      },
      "indicator_count": 26978,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "3 hours ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d68fffbf012630d57033b6",
      "name": "Sabey SWIPPER - Pornhub\u00bbX.Com migration to Twitter | Sabey\u2019s Daddy Data Center ",
      "description": "",
      "modified": "2026-04-08T17:27:27.851000",
      "created": "2026-04-08T17:27:27.851000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69bea426487bffa5384c6f38",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "11 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bea426487bffa5384c6f38",
      "name": " Brian Sabey illegally deleting IoC\u2019s | SWIPPER - Pornhub\u00bbX.Com migration to Twitter Sabey Erasing",
      "description": "",
      "modified": "2026-03-21T13:59:02.016000",
      "created": "2026-03-21T13:59:02.016000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "29 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68888ed9c3a537ac4491eba7",
      "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration [scoreblue]",
      "description": "",
      "modified": "2025-07-29T09:05:29.205000",
      "created": "2025-07-29T09:05:29.205000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "264 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d4916fa7338286448118a1",
      "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com migration to Twitter ",
      "description": "",
      "modified": "2024-10-19T18:02:34.237000",
      "created": "2024-09-01T16:08:15.260000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ccbd92f716bb0ca0fda93d",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 935,
        "URL": 5882,
        "domain": 571,
        "hostname": 1418,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 9054,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "546 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "670268310c19cecfd0fdce4b",
      "name": "Jeffrey Reimer PT DPT | Brian Sabey - Pornhub Campaigns X.Com",
      "description": "",
      "modified": "2024-10-06T10:36:33.718000",
      "created": "2024-10-06T10:36:33.718000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "560 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66eb08c239be3721ab6c9050",
      "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration to Twitter",
      "description": "",
      "modified": "2024-10-06T10:30:32.632000",
      "created": "2024-09-18T17:07:14.432000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66d4916fa7338286448118a1",
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "560 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66c66b55663b96406b28c28c",
      "name": "x.com - Porn Smear | Brian Sabey | Sabey Data Centers & Swipp-a-dee-doo-dah ",
      "description": "",
      "modified": "2024-09-20T03:00:51.533000",
      "created": "2024-08-21T22:33:57.501000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66c5db8e996dcef20be8a618",
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 303,
        "URL": 906,
        "domain": 258,
        "hostname": 308,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 2019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "576 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66ccbd92f716bb0ca0fda93d",
      "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com - allows redirection for member abuse of Crime Victim",
      "description": "",
      "modified": "2024-09-20T03:00:51.533000",
      "created": "2024-08-26T17:38:26.472000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ca36c85ccdb4c97c164228",
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 303,
        "URL": 906,
        "domain": 258,
        "hostname": 308,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 2019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "576 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mott.appleid.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mott.appleid.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776620758.1910675
}