{
  "type": "URL",
  "indicator": "https://mx0.venexus.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mx0.venexus.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3325186176,
      "indicator": "https://mx0.venexus.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 46,
      "pulses": [
        {
          "id": "69b49ad5dd40a24d83cd6a72",
          "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-03-13T23:16:37.716000",
          "created": "2026-03-13T23:16:37.716000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69631fbd16e306ee2b76c4da",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "37 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b496396ca4987e95ad37d1",
          "name": "Chris Buzz by QVashni (wow)",
          "description": "",
          "modified": "2026-03-13T22:56:57.314000",
          "created": "2026-03-13T22:56:57.314000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69482caa00d327da8f0a87bc",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "37 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b49587dd104e342dda1628",
          "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
          "description": "",
          "modified": "2026-03-13T22:53:59.112000",
          "created": "2026-03-13T22:53:59.112000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "37 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69631fbd16e306ee2b76c4da",
          "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2026-01-11T03:57:49.242000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "695557ee134b978b00883c29",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695557ee134b978b00883c29",
          "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-31T17:05:50.134000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69482caa00d327da8f0a87bc",
          "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-21T17:21:46.434000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "691f4d4ef0a2a570b8b21cd2",
          "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
          "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-11-20T17:18:06.929000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68743733a69ce827f6156f5c",
          "name": "W3.org | Google Spy engine | Tracking, Malware Repository | www.W3.org https://www.searchw3.com/ > ww.google.com.uy",
          "description": "",
          "modified": "2025-07-13T22:46:11.685000",
          "created": "2025-07-13T22:46:11.685000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6688e0ffb31d4881f3238713",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4080,
            "URL": 11952,
            "hostname": 4638,
            "domain": 4301,
            "FileHash-MD5": 2236,
            "FileHash-SHA1": 1140,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 28384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "280 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66804428b487338dc16f70a7",
          "name": "Brian Sabey Orbiting Tsara Brashears and associates | Espionage | Said client: Jeffrey Reimer",
          "description": "Brian Sabey & large team continue excessive orbiting target & family members in multiple states. \nUnwarranted, dangerous and illegal. \nLarge attacks have wreaked havoc on medical establishments, targets medical profile, once profitable business, legal manipulation, financial well being. forced poverty, swatting, imfostealer, insurance fraud, intellectual property use, Audi le spying, in person stalking, confrontations, great bodily harm, loss of peace, safety. basic human rights and privacy, phone call redirection, malvertising. In the name of assaulter Jeffrey Scott Reimer",
          "modified": "2024-11-05T10:00:12.606000",
          "created": "2024-06-29T17:28:08.283000",
          "tags": [
            "unknown",
            "united",
            "virgin islands",
            "as51852",
            "as33387",
            "as19905",
            "as44273 host",
            "cname",
            "nxdomain",
            "passive dns",
            "url http",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "entries",
            "urls",
            "files ip",
            "address domain",
            "ip related",
            "pulses otx",
            "pulses",
            "related tags",
            "indicator facts",
            "dga domain",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "pulse pulses",
            "ip address",
            "related nids",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "b59bn timestamp",
            "ff2c217402202b",
            "code",
            "false",
            "url https",
            "domain",
            "trojan",
            "hostname",
            "files",
            "body",
            "date",
            "path max",
            "age86400 set",
            "cookie",
            "script urls",
            "type",
            "mtb may",
            "script script",
            "trojanspy",
            "striven",
            "miles2",
            "rexxfield",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "date sat",
            "gmt server",
            "sakula malware",
            "historical ssl",
            "realteck audio",
            "lemon duck",
            "iocs",
            "tsara brashears",
            "loki password",
            "stealer",
            "windows",
            "auction",
            "metro",
            "core",
            "colibri loader",
            "hacktool",
            "status",
            "for privacy",
            "creation date",
            "record value",
            "name servers",
            "showing",
            "next",
            "mtb mar",
            "ipv4",
            "ransom",
            "west domains",
            "redacted for",
            "gmt location",
            "gmt max",
            "cowboy",
            "encrypt",
            "as60558 phoenix",
            "susp",
            "win32",
            "methodpost",
            "canada unknown",
            "as43350 nforce",
            "united kingdom",
            "as47846",
            "germany unknown",
            "briansabey",
            "body doubles",
            "orbiters",
            "malvertising",
            "cane",
            "get na",
            "show",
            "as16509",
            "delete c",
            "sinkhole cookie",
            "value snkz",
            "cape",
            "possible",
            "copy",
            "nivdort",
            "write",
            "bayrob",
            "malware",
            "exploit",
            "confirm https",
            "impact",
            "misc http",
            "cvss v2",
            "authentication",
            "n cvss",
            "v3 severity",
            "high attack",
            "emails",
            "cnc",
            "alphacrypt cnc",
            "beacon",
            "as15169 google",
            "limited",
            "as8560",
            "elite",
            "AS33387 nocix llc",
            "pegasus",
            "mercenary",
            "cellerebrand",
            "cellebrite",
            "apple",
            "dark",
            "apple ios",
            "ios",
            "apple iphone",
            "apple itunes",
            "itunes",
            "pegasystem",
            "data brokers",
            "hackers",
            "javascript",
            "please",
            "intel",
            "filehash",
            "av detections",
            "xorddos"
          ],
          "references": [
            "http://www.northpoleroute.com/78985064&type=0&resid=5312625",
            "espysite.azurewebsites.net - https://otx.alienvault.com/indicator/hostname/espysite.azurewebsites.net",
            "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
            "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256 aa289c89f2cdbfe896f4c77c611d94aa95858797014b57e24d5fe2bb0997d7b0",
            "Ransom:Win32/Haperlock.A: FileHash-MD5 46480bf46cde2b3e79852661cc5c36fc",
            "Ransom:Win32/Haperlock.A: FileHash-SHA1 c881d1434164b35fb16107a25f84995b7fdef37f",
            "Ransom:Win32/Haperlock.A; FileHash-SHA256 8264c73f129d4895573c2375ea4e4636b9d5df66852ce72ccc20d31a96ae7df1",
            "IDS Detections: W32/Bayrob Attempted Checkin 2 Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin",
            "IDS Detections: Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
            "Alerts: cape_detected_threat cape_extracted_content",
            "https://otx.alienvault.com/indicator/file/251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
            "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
            "\"Windows SMB Information Disclosure Vulnerability.\" - https://otx.alienvault.com/indicator/cve/CVE-2017-0147",
            "Backdoor:Win32/Fynloski.A: FileHash-SHA256 4e692806955f9ee3f4c7a5d9a1ac7729eb53b855b39e6f9f943f89ccba30bd49",
            "Backdoor:Win32/Fynloski.A: FileHash-SHA 453355033bb7977831ca87cc90156b594f13b2ee",
            "Backdoor:Win32/Fynloski.A: FileHash-MD5 c3113684e8f8aa6d1b1b67d59141e845",
            "TrojanClicker:Win32/Ellell.A: FileHash-SHA256 7456108771e6a8bac658276c1cb9e18c8c348fdd9cd3538419751c3b5ef3ac02",
            "TrojanClicker:Win32/Ellell.A: FileHash-SHA1 7a52b57df5b3c67f810a71dc39ff93688b141534",
            "TrojanClicker:Win32/Ellell.A: 4d3e7d486ec5918d91e54e51c4d07dc6",
            "PWS:Win32/Ymacco.AA50: FileHash-SHA256 105834163b1a0c89e12917a3145e14be6030a611e07f7f62fa7c57de838d6251",
            "PWS:Win32/Ymacco.AA50: FileHash-SHA1 57486d33246bce6dfedb0836cd97c9acd4a4a39a",
            "PWS:Win32/Ymacco.AA50: FileHash-MD5 5739cd62eb88e2a7e514784fe7cf5ca4",
            "https://otx.alienvault.com/indicator/ip/162.222.213.199",
            "TrojanDownloader:Win32/PurityScan.MI!MTB: FileHash-SHA1 58ba8715a88d883537ba8d0e20eea2a4d9269cad",
            "Ransom:Win32/Tescrypt: FileHash-SHA256 916e13eb1e4313b2a04a2ae21b4955b8228183b26709a64284098ca759a8f437",
            "PWS:Win32/QQpass.B!MTB: FileHash-SHA256 71fa9257f88c15b438616662dc468327199edb570286c7259d333953006b8eec",
            "PWS:Win32/QQpass.B!MTB: FileHash-SHA1 fec703ee7c02ffe35c6b987bb9aac3a765e95dfb",
            "PWS:Win32/QQpass.B!MTB: FileHash-MD5 f7c36b4e5b4b09dc369163377aade2d7",
            "Trojan:Win32/Zombie.A: FileHash-SHA256 0b87667251b79cb800ddd88bdabecea8e13248c426d4a14ae0aae0ef5783f943",
            "Trojan:Win32/Zombie.A: FileHash-SHA1 de974c697f0401d681e1bb3c8694a663e9e43d8f",
            "Trojan:Win32/Zombie.A: FileHash-MD5 34e85820b41c14e07dd564f22997e893",
            "Win.Virus.TeslaCrypt3-2: 78af1fd5be62ab829e49f9a1b5fbb8a9b30f8d0804cba5805c8f350b841d522e",
            "IDS Detections : W32/Bayrob Attempted Checkin 2 CryptoWall Check-in AlphaCrypt CnC Beacon 4 Trojan-Ransom.Win32.Blocker.avsx",
            "IDS Detections : AlphaCrypt CnC Beacon 3 MalDoc Request for Payload Aug 17 2016 Koobface W32/Bayrob Attempted Checkin",
            "IDS Detections : Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
            "https://otx.alienvault.com/indicator/ip/185.230.63.186",
            "CnC IP's: 192.187.111.221  63.141.242.43  63.141.242.44  63.141.242.46 81.17.18.195  81.17.18.197 81.17.29.146  81.17.29.148",
            "http://islamicsoftwares.com/downloads/iphone/audioCont/2/107.tar.gz http://islamicsoftwares.com/downloads/iphone/audioCont/7/110.tar.gz",
            "smartphonesonline.co.uk  https://smartphonesonline.co.uk/  https://www.smartphonesonline.co.uk/ [192.187.111.222. US - Request HTTP -Target IP]",
            "Mercenary Attackers / Cellebrite branded as: http://teacellertea.com/Pegasus/ NSO",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
            "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
            "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
            "https://otx.alienvault.com/indicator/ip/63.141.242.45",
            "Yara Detections: is__elf ,  xorddos ,  LinuxXorDDoS_VariantTwo",
            "Antivirus Detections: ELF:Xorddos-AE\\ [Trj] ,  Unix.Trojan.Xorddos-1 ,",
            "Trojan:Linux/Xorddos: FileHash-MD5 3b4ce1333614cd21c109054630e959b9",
            "Trojan:Linux/Xorddos:  FileHash-SHA1 a5780498e6fce5933a7e7bf59a6fa5742e97f559",
            "Trojan:Linux/Xorddos: FileHash-SHA256 0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
            "https://hallrender.com/attorney/brian-sabey"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort.CW",
              "display_name": "TrojanSpy:Win32/Nivdort.CW",
              "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
            },
            {
              "id": "Ransom:Win32/Haperlock.A",
              "display_name": "Ransom:Win32/Haperlock.A",
              "target": "/malware/Ransom:Win32/Haperlock.A"
            },
            {
              "id": "Backdoor:Win32/Fynloski.A",
              "display_name": "Backdoor:Win32/Fynloski.A",
              "target": "/malware/Backdoor:Win32/Fynloski.A"
            },
            {
              "id": "TrojanClicker:Win32/Ellell.A",
              "display_name": "TrojanClicker:Win32/Ellell.A",
              "target": "/malware/TrojanClicker:Win32/Ellell.A"
            },
            {
              "id": "Bayrob",
              "display_name": "Bayrob",
              "target": null
            },
            {
              "id": "Win.Virus.TeslaCrypt3-2/Custom",
              "display_name": "Win.Virus.TeslaCrypt3-2/Custom",
              "target": null
            },
            {
              "id": "PWS:Win32/Ymacco.AA50",
              "display_name": "PWS:Win32/Ymacco.AA50",
              "target": "/malware/PWS:Win32/Ymacco.AA50"
            },
            {
              "id": "Ransom:Win32/Tescrypt",
              "display_name": "Ransom:Win32/Tescrypt",
              "target": "/malware/Ransom:Win32/Tescrypt"
            },
            {
              "id": "PWS:Win32/QQpass.B!MTB",
              "display_name": "PWS:Win32/QQpass.B!MTB",
              "target": "/malware/PWS:Win32/QQpass.B!MTB"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan:Linux/Xorddos",
              "display_name": "Trojan:Linux/Xorddos",
              "target": "/malware/Trojan:Linux/Xorddos"
            },
            {
              "id": "Sakula RAT",
              "display_name": "Sakula RAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 106,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3885,
            "hostname": 1651,
            "URL": 5981,
            "FileHash-MD5": 486,
            "FileHash-SHA256": 3859,
            "SSLCertFingerprint": 2,
            "FileHash-SHA1": 487,
            "CVE": 7,
            "email": 8
          },
          "indicator_count": 16366,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "530 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d490668683aec2631cfa20",
          "name": "Jeffrey Reimer DPT Tsara Brashears Court Records | Trellis.Law",
          "description": "Phishing expedition: Malicious bait. Threat actor/s attempting to hack whoever can see and clicks on link. The URl is parked, is malicious, attempts infiltrate device.",
          "modified": "2024-11-05T00:02:43.336000",
          "created": "2024-09-01T16:03:50.411000",
          "tags": [
            "reimer-jeffrey-v-brashears-tsara",
            "2017cv030026  suppressed",
            "case 2017cv030026  suppressed",
            "docket",
            "legal case",
            "legal",
            "litigation",
            "court cases",
            "state court docket",
            "robert r",
            "lung",
            "county",
            "case",
            "money",
            "ben l",
            "leutwyler iii",
            "reimer",
            "brashears",
            "douglas county",
            "tips",
            "district",
            "date",
            "judge",
            "shane",
            "bank",
            "contact",
            "service",
            "brashears accepts",
            "jeffrey scott",
            "reimer dpt",
            "reimer paid",
            "sa victim",
            "settlement",
            "reimer-jeffrey-paid-tsara-brahears-settlement",
            "reimer-jeffrey-claim-dismissed",
            "brashears-tsara-claims-upheld",
            "reverse dns",
            "general full",
            "protocol h2",
            "security tls",
            "resource",
            "united",
            "hash",
            "name value",
            "security",
            "main",
            "facebook",
            "brashears-tsara-v-reimer-jeffrey",
            "so false",
            "as134548 dxtl",
            "kwan o",
            "hong kong",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "export graph",
            "historical ssl",
            "referrer",
            "gameprofitshack",
            "webstudio",
            "smartdata",
            "alloymedia",
            "industries",
            "theakkas",
            "korplug",
            "default",
            "module load",
            "t1129",
            "show",
            "search",
            "regbinary",
            "malware beacon",
            "upatre",
            "suspicious",
            "trojan",
            "copy",
            "dock",
            "downloader",
            "loader",
            "write",
            "malware",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "related pulses",
            "dashboard",
            "browse scan",
            "endpoints all",
            "showing",
            "p2p zeus",
            "september",
            "popper",
            "cookies",
            "x function",
            "hsp boolean",
            "oribili boolean",
            "hstcran",
            "hsusertoken",
            "domainpath name",
            "ns nxdomain",
            "parked",
            "tsara won",
            "brashears prevails",
            "reimer dismissal",
            "dangerous data collection",
            "get device",
            "parked uri"
          ],
          "references": [
            "Scam Aggregators: https://trellis.law/case/8035/2017cv030026-suppressed/reimer-jeffrey-v-brashears-tsara [parked here: ctjsz.com]",
            "http://www.qq664.com/seximanhua/22128.html [looks legit to me]",
            "sex2e.com  | http://qq664.com/seximanhua/22128.html [trellis.law]",
            "https://prnbae.com/191693/at-37-ellie-discovers-the-unique-sensations-of-double-vaginal-sex/ [trellis.law]",
            "http://www.philippinesredcat.com/girls-for-sex-in-manila/ [trellis.law]",
            "http://us.1.powerfront.com/thehealthylivingshow/scripts/redir.asp?link=https://www.sexbestgals.info/cougar-porn/ [trellis.law]",
            "https://help.competitionsuite.com/article/76-using-the-judge-app-tablets",
            "https://www.paidhmars.com/",
            "https://urlscan.io/result/e4ed8a1d-1b23-46cd-a237-a2ad4e974fc3/content/",
            "False: This case was filed in Douglas County Superior Courts with Jeffrey K Holmes presiding. | Who is he?",
            "False: Never served. Had several PI's and background checks",
            "Jeffrey Scott Reimer DPT was allegedly arrested 02/14/2022 |  Very unreliable self proclaimed PI's (multiple)",
            "Brian Sabey begged victim to accept tiny settlement. Contingency, 'Brashears may use  settlement to find hacker.'",
            "Judge Shay Whittaker dismissed Reimers 'malicious' prosecution claom",
            "Reimers case V Brashears in 2017 after Denver Police Major Crimes located Reimer",
            "Brashears documented on corr record she wanted to proceed with case",
            "Brian Sabey Speaking for Jeffrey Scott Reimer DPT refused further court proceedings",
            "Brian Sabey offered Brashears a settlement. Begged her to accept it.",
            "Case: Defamation of character based on truthful reviews left on HealthGrades.",
            "A series of reviews detailing Jeffrey Reimer DPT egregious behavior proved not left by Brashears except 2 with comments -4",
            "Brashears Review: 'He would benefit from more training' [Very considerate considering the complimentary spinal cord injuries 'plural']",
            "Health Grades erased 20+ positive reviews that originated from Reimers email address.",
            "Most of not all  positive Jeffrey Reimer DPT reviews are false.  Reimer wasn't practicing when 'amazing' trat,ent alleged",
            "Brian Sabey. Esq filed motion to dismiss after judge dismissed Reimers meritlesscase",
            "Brian Sabey would  be most foolish after it was determined Brashears was 100% disabled. This was cause by Jeffrey Scott Reimer DPT",
            "Brashears would gladly go to court as stated in court documents to then judge who wished to be briefed by Brashears. Thwarted by Sabey.",
            "Brian Sabey wanted to appear to win. Sandy demanded Brashears remove every patients negative review about Jeffrey Reimer DPT",
            "Brian Sabey had cashiers check delivered to Brashears in person.",
            "Victim is willing to have her attorney post entire court proceedings online , on YouTube and more",
            "There is NO other physical therapist with as many reviews as Jeffrey Reimer DPT, even non offenders. Reimers clientele is largely non-english speaking.",
            "Reimer often criticized non English speakers, large women and short Hispanic men according to witness.",
            "He also spoke frequently about Brashears infamously 'real' large bosom and figure. He decided to touch, grab, grope, assault,injure, beg for more",
            "Jeffrey Scott Reimer PT , DPT. assaulters defense: 'I had to be of the top/front of Brashears, She consented!'",
            "False: Brashears didn't expect this coming. Jeffrey Reimer DPT suddenly jumped on top of Brashears and tried to start a family. He didn't ask.",
            "Unless tampered with, court records will show Brashears dropped as a patient to be told she'd face legal consequences if she did.",
            "Survivor was told an investigation would begin, she'd be safe among other careless things her MD advised",
            "Brashears would LOVE for the true court proceedings to be read. She feels they were hacked away. DougCo was unable to 'print' records 'glitch'",
            "Did I mention she prevailed, won, got a check? Tsara Lynn Brashears survivor; won her counter claim. Weak Reimer claim burned like a dying moth.",
            "Trellis: 3.223.115.185 In cloud provider range: provider=AWS\t  IPv4 34.240.160.162 In cloud provider range: provider=AWS",
            "Trellis: http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT |  https://search.app.goo.gl/?ofl",
            "Trellis: www.youtube.com/watch?v=GyuMozsVyYs \t\u00bb Survivors video references assault. Does not name or depict Reimers likeness.",
            "Trellis: Hostname blockpage.bt.com | hdredirect-lb7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com | itunes.apple.com | search.app.goo.gl  | www.youtube.com",
            "Trellis: https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
            "IDS Detections: Downloader (P2P Zeus dropper UA) Common Upatre Header Structure 2 Upatre Retrieving encoded payload (Common Header Struct)",
            "IDS Detections: Suspicious User-Agent containing Loader Observed TLS Handshake Failure",
            "Trellis: High Priority Alerts: network_icmp modifies_proxy_wpad packer_polymorphic",
            "Trellis:TrojanDownloader:Win32/Upatre.A  | Yara Detections Upack_all_versions",
            "Trellis: secure04-appleid.com | http://secure04-appleid.com | cpcalendars.secure04-appleid.com"
          ],
          "public": 1,
          "adversary": "Parking Crew",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Zbot.SIBG3!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBG3!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBG3!MTB"
            },
            {
              "id": "TrojanDownloader:Win32/Upatre.A",
              "display_name": "TrojanDownloader:Win32/Upatre.A",
              "target": "/malware/TrojanDownloader:Win32/Upatre.A"
            },
            {
              "id": "P2P ZeuS - S0016",
              "display_name": "P2P ZeuS - S0016",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1399",
              "name": "Modify Trusted Execution Environment",
              "display_name": "T1399 - Modify Trusted Execution Environment"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            }
          ],
          "industries": [
            "Research",
            "Telecommunications",
            "Technology",
            "Civilians"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 269,
            "FileHash-SHA1": 266,
            "FileHash-SHA256": 981,
            "domain": 480,
            "hostname": 684,
            "email": 1,
            "URL": 2102
          },
          "indicator_count": 4783,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "530 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6688e0ffb31d4881f3238713",
          "name": "Google Spy engine | Tracking, Malware Repository",
          "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)",
          "modified": "2024-08-05T04:01:42.283000",
          "created": "2024-07-06T06:15:27.994000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 89,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4080,
            "URL": 11952,
            "hostname": 4638,
            "domain": 4301,
            "FileHash-MD5": 2236,
            "FileHash-SHA1": 1140,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 28384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "622 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6688e142f0c8f5ddecbc788c",
          "name": "Google Spy engine | Tracking, Malware Repository",
          "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)",
          "modified": "2024-08-05T04:01:42.283000",
          "created": "2024-07-06T06:16:34.388000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 94,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4080,
            "URL": 11952,
            "hostname": 4638,
            "domain": 4301,
            "FileHash-MD5": 2236,
            "FileHash-SHA1": 1140,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 28384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "622 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6688e15588a794b95443b46d",
          "name": "Google Spy engine | Tracking, Malware Repository",
          "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)\nSorry so sloppy and large.\nAll tags , malware families and ATT&CK mechanisms auto populated",
          "modified": "2024-08-05T02:03:31.529000",
          "created": "2024-07-06T06:16:53.461000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "file size",
            "b file",
            "detections file",
            "gzip chrome",
            "cache entry",
            "graph",
            "ip detections",
            "country",
            "domains",
            "internet domain",
            "service bs",
            "corp",
            "namecheap inc",
            "csc corporate",
            "tucows",
            "epik llc",
            "tucows domains"
          ],
          "references": [
            "https://www.searchw3.com/",
            "IP\u2019s Contacted: 192.124.249.187",
            "Ransomware: message.htm.com",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 73,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 3731,
            "URL": 11926,
            "hostname": 4626,
            "domain": 4135,
            "FileHash-MD5": 1530,
            "FileHash-SHA1": 762,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 26747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "622 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65eff46bdd371899ca5be7d7",
          "name": "CrypterX-gen | Video-lal.com | M. Brian Sabey \u2022 Hall Render | Rexxfield",
          "description": "Videolal results. Parked. Owner of domain has subsidiaries including Huge Domains. It's possible for attacker to post a 404 error page,  park, post it for sale, malvertize. HoneyPotBot? \n\nFireeye. A bit much. william.ballenthin@fireeye.com\t\ncontain a resource (.rsrc) section moritz.raabe@fireeye.com. Overkill. What would Scooby Doo? Scooby!? \nTarget reports opening her MacBook Pro after it was replaced by Apple. It hadn't been in use. She opened it, surprised it was on, automatically connected to a store wifi (she was home) A worker was typing away in terminal. Fought hacker for recordings app containing Jeffrey Reimers aggressions. She lost. Terrified she murdered her MacBook by drowning  & dismemberment. Big mistake. Cloned MacBook.  Clicked on links trigger malicious downloads, network & DNS issues.",
          "modified": "2024-04-11T04:01:24.166000",
          "created": "2024-03-12T06:21:31.484000",
          "tags": [
            "upatre malware",
            "rwi dtools",
            "page dow",
            "security",
            "bitfender",
            "yandex",
            "malware",
            "all octoseek",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "file score",
            "fireeye",
            "injection",
            "worm",
            "trojan",
            "network",
            "poster",
            "honeybots",
            "united",
            "unknown",
            "win32upatre mar",
            "passive dns",
            "entries",
            "ipv4",
            "body",
            "artro",
            "generic malware",
            "formbook",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "generic",
            "hostnames",
            "pattern match",
            "ascii text",
            "png image",
            "root ca",
            "file",
            "authority",
            "indicator",
            "mitre att",
            "ck id",
            "class",
            "date",
            "enterprise",
            "hybrid",
            "accept",
            "general",
            "local",
            "click",
            "strings",
            "trident",
            "as47846",
            "germany unknown",
            "as2906 netflix",
            "scan endpoints",
            "domain",
            "urls",
            "files",
            "trojanspy",
            "mozilla",
            "dynamicloader",
            "medium",
            "title",
            "ms windows",
            "head",
            "intel",
            "inetsim http",
            "delete c",
            "show",
            "winnt",
            "copy",
            "powershell",
            "write",
            "next",
            "suspicious",
            "shop",
            "graph api",
            "status",
            "join",
            "vt community",
            "api key",
            "xcitium verdict",
            "cloud",
            "contacted",
            "contacted urls",
            "ssl certificate",
            "referrer",
            "historical ssl",
            "parent domain",
            "apple ios",
            "resolutions",
            "execution",
            "hacktool",
            "outbound connection",
            "detection list",
            "blacklist"
          ],
          "references": [
            "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
            "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
            "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
            "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
            "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
            "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
            "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
            "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
            "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
            "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
            "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
            "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
            "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
            "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
            "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
            "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
            "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
            "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
            "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
            "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
            "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
            "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
            "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
            "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
            "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
            "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win32:CrypterX-gen\\ [Trj]",
              "display_name": "Win32:CrypterX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Win32.Renos/Artro",
              "display_name": "Win32.Renos/Artro",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "I-Worm/Bagle.QE",
              "display_name": "I-Worm/Bagle.QE",
              "target": null
            },
            {
              "id": "Worm.Bagle-44",
              "display_name": "Worm.Bagle-44",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.DE",
              "display_name": "TrojanSpy:Win32/Nivdort.DE",
              "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
            },
            {
              "id": "Win.Trojan.Generic-9897526-0",
              "display_name": "Win.Trojan.Generic-9897526-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Knigsfot-125",
              "display_name": "Win.Trojan.Knigsfot-125",
              "target": null
            },
            {
              "id": "ALF:TrojanDownloader:Win32/Vadokrist.A",
              "display_name": "ALF:TrojanDownloader:Win32/Vadokrist.A",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-9957168-0",
              "display_name": "Win.Trojan.Generic-9957168-0",
              "target": null
            },
            {
              "id": "Win.Adware.RelevantKnowledge-9821121-0",
              "display_name": "Win.Adware.RelevantKnowledge-9821121-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1622,
            "FileHash-SHA1": 934,
            "FileHash-SHA256": 3289,
            "URL": 9605,
            "domain": 2321,
            "hostname": 2411,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 20186,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "738 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65eedf74b7bdda41057bef3e",
          "name": "Source Browse- DNS poisoning \u2022 Device CnC",
          "description": "Smear + Fear campaign. Parked domain schemes.   Swatting, social engineering, crime staging/framing.  Cyber bully,  shocking, false online content, posters, porn dumping,  injection, CnC devices, master keys, break  & enter. Victim becomes the accused. Framing.  Ability to close bank accounts, skim, call, text, email collection, redirect phone calls, create botnets, engineer malware, injection,divert tax refunds, divert funds, royalties, mail erase job history, attack, hospital, CnC event, IRS audits, fake documentaries, stalkers, attackers, death threats.  MD articulated outcome after being SA'd by their employee they vowed to protect.",
          "modified": "2024-04-10T09:00:27.994000",
          "created": "2024-03-11T10:39:48.949000",
          "tags": [
            "iocs",
            "all octoseek",
            "blacklist https",
            "gmbh version",
            "legal",
            "service privacy",
            "general full",
            "reverse dns",
            "san francisco",
            "asn13335",
            "cloudflarenet",
            "cloudflare",
            "domains",
            "service privacy",
            "modernizr",
            "domainpath name",
            "migrate",
            "phishing",
            "url https",
            "united",
            "line",
            "threat",
            "paste",
            "analyze",
            "value",
            "z6s3i string",
            "a7i string",
            "y3i string",
            "e0b function",
            "x8i string",
            "source level",
            "threat analyzer",
            "urls https",
            "domain",
            "webzilla",
            "cloudflar",
            "system",
            "hostnames",
            "sample",
            "security tls",
            "ecdheecdsa",
            "resource",
            "hash",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "veryhigh",
            "limited",
            "lsalford",
            "ocomodo ca",
            "cncomodo ecc",
            "secure server",
            "olet",
            "encrypt",
            "cnlet",
            "identity search",
            "group",
            "google https",
            "expired",
            "comodo",
            "tls web",
            "log id",
            "criteria id",
            "1663014711",
            "summary leaf",
            "timestamp entry",
            "log operator",
            "error",
            "name size",
            "parent",
            "directory",
            "displays",
            "targets",
            "smartfolder",
            "frame",
            "bookmarks",
            "splitcount",
            "nib files",
            "design",
            "boundsstr",
            "rows",
            "source browser",
            "ruby logo",
            "license",
            "python",
            "python software",
            "foundation",
            "apple inc",
            "php logo",
            "visit",
            "valid",
            "no na",
            "no no",
            "ip security",
            "ca id",
            "research group",
            "cnisrg root",
            "mozilla",
            "android",
            "binrm",
            "targetdisk",
            "create",
            "crlcachedir",
            "makefile",
            "dstroot",
            "keychainssrc",
            "srcroot",
            "crl cache",
            "install",
            "ev server",
            "authentication",
            "subject",
            "digicert https",
            "sectigo https",
            "certificate",
            "ca limited",
            "salford",
            "greater",
            "key usage",
            "access",
            "ca issuers",
            "ocsp",
            "x509v3 subject",
            "lets",
            "identifier",
            "411260982",
            "poison",
            "search",
            "status page",
            "impressum",
            "protocol h2",
            "main",
            "framing",
            "geoip",
            "as13335",
            "centos",
            "as32244",
            "liquidweb",
            "redirect",
            "as16509",
            "as133618",
            "z6s3i y3i",
            "as62597",
            "france unknown",
            "showing",
            "link",
            "z6s3i",
            "date",
            "unknown",
            "meta",
            "sha256",
            "google safe",
            "browsing",
            "hostname",
            "samples",
            "td td",
            "tr tr",
            "a td",
            "a domains",
            "passive dns",
            "a th",
            "urls",
            "as50295 triple",
            "triple mirrors",
            "contact",
            "moved",
            "show",
            "accept",
            "body",
            "microsoft",
            "e4609l",
            "urls http",
            "yoa https",
            "url http",
            "scan endpoints",
            "report spam",
            "created",
            "weeks ago",
            "pulse",
            "brashears",
            "xvideos",
            "capture",
            "expiration",
            "no expiration",
            "entries",
            "status",
            "as58110 ip",
            "for privacy",
            "aaaa",
            "creation date",
            "domain name",
            "germany unknown",
            "bq mar",
            "ipv4",
            "pulse pulses",
            "files",
            "artro",
            "files domain",
            "files related",
            "pulses otx",
            "pulses",
            "tags",
            "servers",
            "record value",
            "body doctype",
            "html public",
            "macintosh",
            "intel mac",
            "os x",
            "technology",
            "dns replication",
            "email",
            "server",
            "registrar abuse",
            "dnssec",
            "expiration date",
            "registrar iana",
            "admin country",
            "tech country",
            "registry admin",
            "url text",
            "facebook url",
            "google url",
            "google",
            "software",
            "asn15169",
            "ip https",
            "february",
            "request chain",
            "http",
            "referer",
            "aes128gcm",
            "pragma",
            "frankfurt",
            "germany",
            "asn213250",
            "itpsolutions",
            "full url",
            "software caddy",
            "express",
            "ubuntu",
            "as14061",
            "digitaloceanasn",
            "address as",
            "april",
            "facebook",
            "march",
            "hashes",
            "ip address",
            "as autonomous",
            "fastly",
            "packet",
            "kb script",
            "b script",
            "october",
            "resource path",
            "size",
            "type mimetype",
            "redirect chain",
            "kb image",
            "b image",
            "cname",
            "as32244 liquid",
            "trojan",
            "high",
            "yara rule",
            "sniffs",
            "windows",
            "anomalous file",
            "medium",
            "guard",
            "filehash",
            "js user",
            "python connection",
            "brian sabey",
            "smithtech",
            "rexxfield",
            "connect facebook",
            "open",
            "emails",
            "next",
            "ssl certificate",
            "contacted",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "execution",
            "whois whois",
            "contacted urls",
            "linkid69157 url",
            "formbook",
            "spyware",
            "generic malware",
            "tag count",
            "sat jul",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "generic",
            "alerts",
            "icmp traffic",
            "cust exe",
            "depot tech",
            "office depot",
            "tech",
            "customer client",
            "june",
            "copy",
            "network_icmp",
            "inject-x64.exe",
            "tsara brashears",
            "apple ios",
            "hacktool",
            "download",
            "malware",
            "relic",
            "monitoring",
            "tofsee",
            "https://otx.alienvault.com/pulse/65acace20c18a7d6c5da2e27",
            "darklivity",
            "hijacker",
            "remote attackers",
            "cybercrime",
            "fear factor",
            "criminal gang",
            "jeffrey reimer",
            "miles it",
            "history killer",
            "apple",
            "apple control",
            "sreredrum",
            "men",
            "man",
            "hit"
          ],
          "references": [
            "videolal.com [Exploitation for privilege - Turns victim into target then spys, smears, embeds pornography in devices]",
            "videolal.com was first found hosted : https://rexxfield.com/ | https://crt.sh/?id=410492573 | https://crt.sh/?id=411260982",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/michael.pbxuser.auto.html",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/project.pbxproj.auto.html",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/roots/",
            "https://crt.sh/?q=videolal.com",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/Makefile.auto.html",
            "https://opensource.apple.com/source/security_certificates/",
            "https://crt.sh/?q=videolal.com",
            "https://crt.sh/?graph=410492573&opt=nometadata",
            "https://crt.sh/?spkisha256=2c5ef644a15ed2d591aee707a125b2870da480a0bc16d78022a311c93aca5b15",
            "Tracey Richter smear included Brashears: http://video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
            "Tracey Richter smear:  video-lal.com/videos/diabolical-sentencing.html",
            "Tracey Richter smear:  video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
            "Tracey Richter smear: video-lal.com/video/fbcwPGTSo5lrA7e/tracey-richter-documentary?cpc=no",
            "Malware hosting: http://videolan.mirror.triple-it.nl/vlc-android/3.0.4/VLC-Android-3.0.4-ARMv7.apk",
            "video-lal.com/videos/sandra-richter-video.html",
            "Denver Attorney Frank Azar Smear: video-lal.com/videos/sherryce-emery-frank-azar-&-associates.html",
            "Brashears smear: video-lal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://tx-p2p-pull.video-voip.com.dorm.com/Accept-Language",
            "Crazy: video-lal.com/videos/michael-roberts.html",
            "https://urlscan.io/screenshots/e40cd846-7c34-45a5-9f79-fea139f5b1ee.png",
            "http://secure.applegiftcard.com \u2022 199.59.243.224: http://tx-p2p-pull.video-voip.com.dorm.com \u2022 199.59.243.224: http://wpad.dorm.com",
            "notonmytrack.info \u2022 http://notonmytrack.info \u2022 https://pochta-rf.ru/track74157857 \u2022 patch-tracker.gnewsense.org \u2022 mysql.snore.co",
            "Darren Meade: https://urlscan.io/result/e5f1d6fe-036e-4291-8595-0a33e5dacba5/#behaviour \u2022 alleged partner turned enemy of Michael Roberts",
            "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe | smithsthermopadtool.com",
            "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe \u2022",
            "Unclear given names authentic. Michael Roberts, Darren Mitchell Meade , M. Brian Sabey could be used interchangeably. Black hats w/pseudonyms.",
            "Smith tech may refer to Det. Ben Smith. HallRender; a media company, producing nonsensical, albeit convincing evidence of deeply fake content.",
            "Possibly false names given by individual involved. Brian Sabey Hall Render | Michael Roberts Rexxfield |  Darren Meade former partner of Roberts",
            "Responsible reopening Richter case via alleged Detective Ben Smith | Names Below  linked to porn spewing Videolan , Videolal, Video-lal (Honeypots?) |",
            "http://www.hallrender.com/attorney/brian-sabey |",
            "Sabey: https://www.google.com/search?q=tsara+brashears&client=ms-android-tmus-us-rvc3&sca_esv=52c806ab62ec5c59&cs=1&prmd=inv&filter=0&biw=347&bih=710&dpr=2.08#ip=1",
            "https://www.hallrender.com/attorney/brian-sabey",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png | www.hallrender.com | rexxfield.com",
            "http://usb.smithtech.us  \u2022 http://usb.smithtech.us/apps/downloads/NSISPortable.exe \u2022 http://usb.smithtech.us/apps/downloads/xplorer2.lite.portable.exe",
            "http://usb.smithtech.us/projects/downloads/\u2022 http://usb.smithtech.us/projects/downloads/psu.exe \u2022 smithsthermopadtool.com",
            "servicer.mgid.com \u2022 http://iv-u15.com/imbd-104-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-\u00e5\u00a4\u008f\u00e5\u00b0\u2018\u00e5\u00a5\u00b3-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-blu-ray \u2022 https://load77.exelator.com/pixel.gif",
            "brain-portal.net",
            "303 Status. Ide redirect from: https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
            "https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
            "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
            "https://otx.alienvault.com/pulse/64d018ee4623e8fcd386c2e1",
            "https://otx.alienvault.com/pulse/65418472eb20b10ee5510fde",
            "https://otx.alienvault.com/pulse/64d65255c80d866add600bac",
            "https://otx.alienvault.com/pulse/65204565ac1e8bce4de26df3",
            "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
            "https://otx.alienvault.com/pulse/65a342310ab3d2c69778d608",
            "Refuses to remove target from adult content \"tagging\""
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "Australia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Win.Malware.Farfli-6824119-0",
              "display_name": "Win.Malware.Farfli-6824119-0",
              "target": null
            },
            {
              "id": "Win32:TrojanX-Gen[Trj]",
              "display_name": "Win32:TrojanX-Gen[Trj]",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1049",
              "name": "System Network Connections Discovery",
              "display_name": "T1049 - System Network Connections Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1574.006",
              "name": "Dynamic Linker Hijacking",
              "display_name": "T1574.006 - Dynamic Linker Hijacking"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1602.002",
              "name": "Network Device Configuration Dump",
              "display_name": "T1602.002 - Network Device Configuration Dump"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5328,
            "domain": 2339,
            "hostname": 2434,
            "FileHash-MD5": 1210,
            "FileHash-SHA1": 721,
            "FileHash-SHA256": 2784,
            "SSLCertFingerprint": 5,
            "CVE": 2,
            "URI": 2,
            "email": 10,
            "CIDR": 3
          },
          "indicator_count": 14838,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "739 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a39f005c7f0a1c1eb33125",
          "name": "Formbook",
          "description": "FormBook is a data stealer that is being distributed as a MaaS. FormBook is available in the dark web market as a Malware-as-Service.\n I n known situations targets were contacted by bad actors  via social media accounts Twitter & Facebook.",
          "modified": "2024-03-21T10:00:24.070000",
          "created": "2024-01-14T08:44:48.297000",
          "tags": [
            "ssl certificate",
            "contacted",
            "execution",
            "ah6itbtgl",
            "whois record",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "formbook",
            "threat roundup",
            "malware",
            "metro",
            "social engineering",
            "jansky",
            "script urls",
            "a domains",
            "united",
            "search",
            "date",
            "script domains",
            "creation date",
            "record value",
            "showing",
            "unknown",
            "meta",
            "body",
            "encrypt",
            "as63949 linode",
            "as41357",
            "united kingdom",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse submit",
            "url analysis",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "email",
            "registry domain",
            "win32 exe",
            "javascript",
            "eqsray",
            "zip blaze",
            "ms excel",
            "detections type",
            "name",
            "text",
            "csv order",
            "files",
            "microsoft",
            "dns replication",
            "bt6lcuigydc9yc",
            "jxaavf4jnzza0",
            "submission",
            "community score",
            "no security",
            "graph api",
            "status",
            "content type",
            "xcitium verdict",
            "cloud marketing",
            "history first",
            "thebrotherssabey",
            "passive dns",
            "gmt content",
            "plesklin",
            "ipv4",
            "pulse pulses",
            "urls",
            "vbs",
            "data center",
            "reverse dns",
            "first",
            "utc submissions",
            "submitters",
            "bbonline uk",
            "namecheap inc",
            "summary iocs",
            "graph community",
            "ionos se",
            "keysystems gmbh",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "sabey",
            "all search",
            "otx octoseek",
            "url http",
            "http",
            "hostname",
            "files domain",
            "msie",
            "chrome",
            "expiration date",
            "next",
            "whois lookup",
            "dnssec",
            "domain name",
            "abuse contact",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "cname",
            "as44273 host",
            "ip address"
          ],
          "references": [
            "appleremote.net",
            "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
            "FormBook",
            "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
            "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1708,
            "hostname": 1920,
            "domain": 2221,
            "URL": 4822,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 119,
            "email": 2,
            "CIDR": 1
          },
          "indicator_count": 10893,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "759 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a4880cf26f0feaf9a75648",
          "name": "Formbook",
          "description": "",
          "modified": "2024-02-13T08:03:20.064000",
          "created": "2024-01-15T01:19:08.041000",
          "tags": [
            "ssl certificate",
            "contacted",
            "execution",
            "ah6itbtgl",
            "whois record",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "formbook",
            "threat roundup",
            "malware",
            "metro",
            "social engineering",
            "jansky",
            "script urls",
            "a domains",
            "united",
            "search",
            "date",
            "script domains",
            "creation date",
            "record value",
            "showing",
            "unknown",
            "meta",
            "body",
            "encrypt",
            "as63949 linode",
            "as41357",
            "united kingdom",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse submit",
            "url analysis",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "email",
            "registry domain",
            "win32 exe",
            "javascript",
            "eqsray",
            "zip blaze",
            "ms excel",
            "detections type",
            "name",
            "text",
            "csv order",
            "files",
            "microsoft",
            "dns replication",
            "bt6lcuigydc9yc",
            "jxaavf4jnzza0",
            "submission",
            "community score",
            "no security",
            "graph api",
            "status",
            "content type",
            "xcitium verdict",
            "cloud marketing",
            "history first",
            "thebrotherssabey",
            "passive dns",
            "gmt content",
            "plesklin",
            "ipv4",
            "pulse pulses",
            "urls",
            "vbs",
            "data center",
            "reverse dns",
            "first",
            "utc submissions",
            "submitters",
            "bbonline uk",
            "namecheap inc",
            "summary iocs",
            "graph community",
            "ionos se",
            "keysystems gmbh",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "sabey",
            "all search",
            "otx octoseek",
            "url http",
            "http",
            "hostname",
            "files domain",
            "msie",
            "chrome",
            "expiration date",
            "next",
            "whois lookup",
            "dnssec",
            "domain name",
            "abuse contact",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "cname",
            "as44273 host",
            "ip address"
          ],
          "references": [
            "appleremote.net",
            "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
            "FormBook",
            "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
            "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65a39f005c7f0a1c1eb33125",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1650,
            "hostname": 1778,
            "domain": 2102,
            "URL": 4435,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 119,
            "email": 2,
            "CIDR": 1
          },
          "indicator_count": 10187,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "796 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a48ab7cd0bd218b17ccf6c",
          "name": "Botnet Command and Control Server | Malware",
          "description": "",
          "modified": "2024-02-06T20:02:52.205000",
          "created": "2024-01-15T01:30:31.655000",
          "tags": [
            "passive dns",
            "urls",
            "scan endpoints",
            "all octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "status code",
            "body",
            "httponly",
            "ssl certificate",
            "historical ssl",
            "whois record",
            "parent referrer",
            "whois whois",
            "communicating",
            "contacted",
            "contacted urls",
            "bundled",
            "pe resource",
            "dropped",
            "army",
            "machinename",
            "execution",
            "referrer",
            "malware distribution site",
            "phishing dropbox",
            "evasive",
            "banker",
            "dde",
            "dridex",
            "exploit",
            "dyre",
            "dyreza",
            "ransomware",
            "mydoom",
            "backdoor",
            "svg",
            "phising",
            "locky",
            "e-mail provider phishing",
            "spear phishing",
            "retefe",
            "defacement",
            "phishing development bank of singapore",
            "banjori",
            "suppobox",
            "zeus",
            "pony",
            "solar",
            "ransomware locky distribution site",
            "nymaim",
            "shade",
            "troldesh",
            "tvrat",
            "zbot",
            "elocky",
            "wisdomeyes",
            "kryptic",
            "sinkhole",
            "exploit",
            "worm",
            "backdoor",
            "injector",
            "botnet command and control server",
            "unknown",
            "domain",
            "creation date",
            "search",
            "date",
            "hostname",
            "next",
            "all search",
            "otx octoseek",
            "united",
            "as13335",
            "ipv4",
            "pulse submit",
            "url analysis",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "files",
            "nxdomain",
            "win32",
            "meta",
            "wabot",
            "gmt contenttype",
            "dnssec",
            "name",
            "win32 exe",
            "detections file",
            "file size",
            "kb file",
            "domains",
            "registrar",
            "markmonitor inc",
            "status",
            "susp",
            "expiration date",
            "name servers",
            "domain related",
            "entries",
            "johnnsabey",
            "m. brian sabey",
            "mark sabey",
            "sabey data center",
            "utah",
            "http method",
            "http requests",
            "connect http",
            "get dns",
            "resolutions",
            "ip traffic",
            "problems",
            "alienvault part",
            "kgs0",
            "kls0",
            "schema abuse",
            "sneaky server",
            "iframe",
            "apple",
            "data collection"
          ],
          "references": [
            "http://security.didici.cc/cve"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "virus.virlock/nabucur",
              "display_name": "virus.virlock/nabucur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            },
            {
              "id": "Banjori",
              "display_name": "Banjori",
              "target": null
            },
            {
              "id": "Trojan.AvsEtecer",
              "display_name": "Trojan.AvsEtecer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "TV RAT",
              "display_name": "TV RAT",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Dyre",
              "display_name": "Dyre",
              "target": null
            },
            {
              "id": "ELocky",
              "display_name": "ELocky",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Locky (Decryptor)",
              "display_name": "Locky (Decryptor)",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan.WisdomEyes.16070401.9500",
              "display_name": "Trojan.WisdomEyes.16070401.9500",
              "target": null
            },
            {
              "id": "Gen:Variant.Strictor",
              "display_name": "Gen:Variant.Strictor",
              "target": null
            },
            {
              "id": "Adware.BrowseFox",
              "display_name": "Adware.BrowseFox",
              "target": null
            },
            {
              "id": "W32.eHeur",
              "display_name": "W32.eHeur",
              "target": null
            },
            {
              "id": "MSIL_Kryptik.P.gen",
              "display_name": "MSIL_Kryptik.P.gen",
              "target": null
            },
            {
              "id": "pykspa_v2_fake",
              "display_name": "pykspa_v2_fake",
              "target": null
            },
            {
              "id": "Worm:Win32/Pykspa",
              "display_name": "Worm:Win32/Pykspa",
              "target": "/malware/Worm:Win32/Pykspa"
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "TEL:Exploit:Win32/Sinkers",
              "display_name": "TEL:Exploit:Win32/Sinkers",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1594",
              "name": "Search Victim-Owned Websites",
              "display_name": "T1594 - Search Victim-Owned Websites"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659b0fd1ac7cb4d83834db1f",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 231,
            "FileHash-SHA256": 3121,
            "URL": 4225,
            "domain": 1725,
            "hostname": 1416,
            "FileHash-SHA1": 225,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10948,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659b0fd1ac7cb4d83834db1f",
          "name": "Botnet Command and Control Server | Malware Distribution Site",
          "description": "",
          "modified": "2024-02-06T20:02:52.205000",
          "created": "2024-01-07T20:55:45.006000",
          "tags": [
            "passive dns",
            "urls",
            "scan endpoints",
            "all octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "status code",
            "body",
            "httponly",
            "ssl certificate",
            "historical ssl",
            "whois record",
            "parent referrer",
            "whois whois",
            "communicating",
            "contacted",
            "contacted urls",
            "bundled",
            "pe resource",
            "dropped",
            "army",
            "machinename",
            "execution",
            "referrer",
            "malware distribution site",
            "phishing dropbox",
            "evasive",
            "banker",
            "dde",
            "dridex",
            "exploit",
            "dyre",
            "dyreza",
            "ransomware",
            "mydoom",
            "backdoor",
            "svg",
            "phising",
            "locky",
            "e-mail provider phishing",
            "spear phishing",
            "retefe",
            "defacement",
            "phishing development bank of singapore",
            "banjori",
            "suppobox",
            "zeus",
            "pony",
            "solar",
            "ransomware locky distribution site",
            "nymaim",
            "shade",
            "troldesh",
            "tvrat",
            "zbot",
            "elocky",
            "wisdomeyes",
            "kryptic",
            "sinkhole",
            "exploit",
            "worm",
            "backdoor",
            "injector",
            "botnet command and control server",
            "unknown",
            "domain",
            "creation date",
            "search",
            "date",
            "hostname",
            "next",
            "all search",
            "otx octoseek",
            "united",
            "as13335",
            "ipv4",
            "pulse submit",
            "url analysis",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "files",
            "nxdomain",
            "win32",
            "meta",
            "wabot",
            "gmt contenttype",
            "dnssec",
            "name",
            "win32 exe",
            "detections file",
            "file size",
            "kb file",
            "domains",
            "registrar",
            "markmonitor inc",
            "status",
            "susp",
            "expiration date",
            "name servers",
            "domain related",
            "entries",
            "johnnsabey",
            "m. brian sabey",
            "mark sabey",
            "sabey data center",
            "utah",
            "http method",
            "http requests",
            "connect http",
            "get dns",
            "resolutions",
            "ip traffic",
            "problems",
            "alienvault part",
            "kgs0",
            "kls0",
            "schema abuse",
            "sneaky server",
            "iframe",
            "apple",
            "data collection"
          ],
          "references": [
            "http://security.didici.cc/cve"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "virus.virlock/nabucur",
              "display_name": "virus.virlock/nabucur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            },
            {
              "id": "Banjori",
              "display_name": "Banjori",
              "target": null
            },
            {
              "id": "Trojan.AvsEtecer",
              "display_name": "Trojan.AvsEtecer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "TV RAT",
              "display_name": "TV RAT",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Dyre",
              "display_name": "Dyre",
              "target": null
            },
            {
              "id": "ELocky",
              "display_name": "ELocky",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Locky (Decryptor)",
              "display_name": "Locky (Decryptor)",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan.WisdomEyes.16070401.9500",
              "display_name": "Trojan.WisdomEyes.16070401.9500",
              "target": null
            },
            {
              "id": "Gen:Variant.Strictor",
              "display_name": "Gen:Variant.Strictor",
              "target": null
            },
            {
              "id": "Adware.BrowseFox",
              "display_name": "Adware.BrowseFox",
              "target": null
            },
            {
              "id": "W32.eHeur",
              "display_name": "W32.eHeur",
              "target": null
            },
            {
              "id": "MSIL_Kryptik.P.gen",
              "display_name": "MSIL_Kryptik.P.gen",
              "target": null
            },
            {
              "id": "pykspa_v2_fake",
              "display_name": "pykspa_v2_fake",
              "target": null
            },
            {
              "id": "Worm:Win32/Pykspa",
              "display_name": "Worm:Win32/Pykspa",
              "target": "/malware/Worm:Win32/Pykspa"
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "TEL:Exploit:Win32/Sinkers",
              "display_name": "TEL:Exploit:Win32/Sinkers",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1594",
              "name": "Search Victim-Owned Websites",
              "display_name": "T1594 - Search Victim-Owned Websites"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 231,
            "FileHash-SHA256": 3121,
            "URL": 4225,
            "domain": 1725,
            "hostname": 1416,
            "FileHash-SHA1": 225,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10948,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6558c481715409563073cb79",
          "name": "Fraud Services",
          "description": "http://kramtechnology.com/, fraud services, network, rat, trojan, phishing, malvertizing, malware hosting, scanning host, archives browser events.",
          "modified": "2023-12-18T05:05:36.760000",
          "created": "2023-11-18T14:04:48.923000",
          "tags": [
            "methodpost",
            "dropped",
            "contacted",
            "ssl certificate",
            "whois record",
            "zva8k4ghshhpcb5",
            "contacted urls",
            "q0gpyr1balpdgpo",
            "historical ssl",
            "page dow",
            "blacklist http",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "paypal",
            "team phishing",
            "malicious url",
            "alexa",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "malware",
            "united",
            "passive dns",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "reverse dns",
            "twitter",
            "log id",
            "gmtn",
            "sectigo rsa",
            "secure server",
            "tls web",
            "salford",
            "sectigo limited",
            "ocsp",
            "false",
            "california",
            "british virgin",
            "locality",
            "d3 a5",
            "url http"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14816,
            "FileHash-MD5": 41,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 5158,
            "domain": 3758,
            "hostname": 2961,
            "email": 4,
            "SSLCertFingerprint": 3,
            "CVE": 3
          },
          "indicator_count": 26777,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "853 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a823f8dbade2ab32ee77",
          "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. Content reputation.",
          "description": "",
          "modified": "2023-12-06T16:58:11.569000",
          "created": "2023-12-06T16:58:11.569000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 7,
            "FileHash-SHA256": 598,
            "hostname": 403,
            "domain": 583,
            "URL": 1814,
            "FileHash-MD5": 175,
            "FileHash-SHA1": 95
          },
          "indicator_count": 3675,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a6a1be1f5233855ae116",
          "name": "Communication Device exploit",
          "description": "",
          "modified": "2023-12-06T16:51:45.122000",
          "created": "2023-12-06T16:51:45.122000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1682,
            "domain": 434,
            "hostname": 678,
            "FileHash-SHA1": 32,
            "URL": 4050,
            "FileHash-MD5": 32
          },
          "indicator_count": 6908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a684ac21d7733c8e1041",
          "name": "Remcos \u2022 Communication Device exploit \u2022 C2",
          "description": "",
          "modified": "2023-12-06T16:51:16.351000",
          "created": "2023-12-06T16:51:16.351000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1682,
            "domain": 434,
            "hostname": 678,
            "FileHash-SHA1": 32,
            "URL": 4050,
            "FileHash-MD5": 32
          },
          "indicator_count": 6908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a64f0bda3d89bf44603f",
          "name": "Remcos \u2022 Communication Device exploit \u2022 C2",
          "description": "",
          "modified": "2023-12-06T16:50:23.738000",
          "created": "2023-12-06T16:50:23.738000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1682,
            "domain": 434,
            "hostname": 678,
            "FileHash-SHA1": 32,
            "URL": 4050,
            "FileHash-MD5": 32
          },
          "indicator_count": 6908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708e0601ea9f27bdebdf4b",
          "name": "Merry Christmas RUs Chasers",
          "description": "",
          "modified": "2023-12-06T15:06:45.654000",
          "created": "2023-12-06T15:06:45.654000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1727,
            "CVE": 1,
            "domain": 1477,
            "URL": 4663,
            "hostname": 1110
          },
          "indicator_count": 8978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570813ddd74469eac78106d",
          "name": "GeraldWood.com ~ Mesa County Administrative Assistant",
          "description": "",
          "modified": "2023-12-06T14:12:13.813000",
          "created": "2023-12-06T14:12:13.813000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 325,
            "hostname": 593,
            "domain": 560,
            "URL": 2264,
            "email": 4,
            "FileHash-SHA1": 3
          },
          "indicator_count": 3749,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570804e9e8bff4f97713ab0",
          "name": "AnthonyGutierrez.com  ~ Executive Director of Common Cause Texas",
          "description": "",
          "modified": "2023-12-06T14:08:14.265000",
          "created": "2023-12-06T14:08:14.265000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 71,
            "FileHash-SHA256": 142,
            "domain": 130,
            "URL": 363,
            "FileHash-SHA1": 9,
            "email": 1
          },
          "indicator_count": 716,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707fb98073ae7c257ccd92",
          "name": "Truthsocial.com",
          "description": "",
          "modified": "2023-12-06T14:05:45.403000",
          "created": "2023-12-06T14:05:45.403000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1804,
            "FileHash-SHA256": 1282,
            "hostname": 598,
            "domain": 372,
            "SSLCertFingerprint": 2,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2
          },
          "indicator_count": 4062,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6544cbbca7610e92e4262c47",
          "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Targeting",
          "description": "",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-11-03T10:30:20.965000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": "654140bae73f795aa914e8de",
          "export_count": 108,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654140bae73f795aa914e8de",
          "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears",
          "description": "",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-31T18:00:26.439000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": "65401d73e96dd70037ed22a7",
          "export_count": 98,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d8480e4a9ed725f6458",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:56.820000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d76b057b79aaf7ba4a7",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:40.239000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 84,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d73e96dd70037ed22a7",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:39.802000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d5ee5a7359a5e815a6a",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:18.712000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1b570ce3f6227774113b",
          "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. ",
          "description": "",
          "modified": "2023-11-07T08:04:06.581000",
          "created": "2023-10-30T02:56:23.462000",
          "tags": [
            "heur",
            "cyber threat",
            "engineering",
            "covid19",
            "united",
            "phishing site",
            "telefonica peru",
            "malicious site",
            "control server",
            "phishing",
            "suppobox",
            "malware",
            "team",
            "ransomware",
            "download",
            "facebook",
            "daum",
            "cobalt strike",
            "pony",
            "artemis",
            "simda",
            "sodinokibi",
            "zbot",
            "bank",
            "feodo",
            "laplasclipper",
            "squirrelwaffle",
            "binder",
            "virut",
            "ramnit",
            "dropper",
            "formbook",
            "azorult",
            "revil",
            "matsnu",
            "service",
            "generic",
            "malicious",
            "emotet",
            "br",
            "trojanspy",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware site",
            "blacklist",
            "alexa",
            "malicious url",
            "detection list",
            "INDICATOR ROLE TITLE DESCRIPTION EXPIRATION RELATED PULSES  URL ",
            "C2",
            "command_and_control",
            "nr-data",
            "cyber crime",
            "impersonation",
            "fraud",
            "intellectual property",
            "targets",
            "kedence",
            "song culture",
            "tsara lynn",
            "k\u00e9dence",
            "tsara",
            "tsara brashears",
            "social engineering",
            "interface exchange",
            "abuse",
            "privilege",
            "indicator",
            "file",
            "pattern match",
            "ascii text",
            "appdata",
            "windows nt",
            "script",
            "mitre att",
            "ck id",
            "show technique",
            "hybrid",
            "general",
            "local",
            "forced login",
            "content reputation",
            "reputation",
            "scheme",
            "crime",
            "cyber criminals",
            "arizona",
            "colorado",
            "newyork",
            "british",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "suricata",
            "suricata",
            "cloud",
            "device remotwd",
            "remote attack",
            "remote controlled devices",
            "tracking",
            "spyware",
            "florida",
            "united states",
            "canada",
            "estonia",
            "cyber criminal",
            "alert"
          ],
          "references": [
            "smartwishlist_1_.js",
            "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558",
            "CVE-2012-1856",
            "CVE-2013-1331",
            "CVE-2017-8570",
            "CVE-2017-0147",
            "CVE-2017-11882",
            "CVE-2017-0199",
            "CVE-2018-8453",
            "https://the.sciencebehindecommerce.com/d9core",
            "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com",
            "https://www.miraclebrand.co/apps/wonderment/tracking",
            "remote-access.net",
            "dev.remote-access.net",
            "hubspot.remote-access.net",
            "http://avient.remote-access.net/",
            "qa.remote-access.net",
            "http://www.remote-access.net",
            "https://avient.remote-access.net",
            "bam.nr-data.net",
            "appleaccessory.online",
            "init.ess.apple.com",
            "tv.apple.com",
            "http://icloud.ypcdce.com",
            "dr4qe3ddw9y32.cloudfront.net",
            "http://45.159.189.105/bot/regex",
            "http://clipper.guru/bot/regex",
            "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34",
            "cloud.smartwishlist.webmarked.net",
            "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html",
            "https://hubspot.remote-access.net",
            "icloud.ypcdce.com",
            "Research and Data analysis"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "BR",
              "display_name": "BR",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Emotet - S0367",
              "display_name": "Emotet - S0367",
              "target": null
            },
            {
              "id": "Squirrelwaffle",
              "display_name": "Squirrelwaffle",
              "target": null
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Virus:Win32/Daum",
              "display_name": "Virus:Win32/Daum",
              "target": "/malware/Virus:Win32/Daum"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Backdoor:PHP/Artemis",
              "display_name": "Backdoor:PHP/Artemis",
              "target": "/malware/Backdoor:PHP/Artemis"
            },
            {
              "id": "TEL:HackTool:Win32/ArtemisUser",
              "display_name": "TEL:HackTool:Win32/ArtemisUser",
              "target": null
            },
            {
              "id": "Azorult - S0344",
              "display_name": "Azorult - S0344",
              "target": null
            },
            {
              "id": "Feodo",
              "display_name": "Feodo",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Simda",
              "display_name": "Backdoor:Win32/Simda",
              "target": "/malware/Backdoor:Win32/Simda"
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Formbook",
              "display_name": "Formbook",
              "target": null
            },
            {
              "id": "REvil (ELF)",
              "display_name": "REvil (ELF)",
              "target": null
            },
            {
              "id": "Trojan:Win32/Matsnu",
              "display_name": "Trojan:Win32/Matsnu",
              "target": "/malware/Trojan:Win32/Matsnu"
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Zbot",
              "display_name": "Backdoor:Win32/Zbot",
              "target": "/malware/Backdoor:Win32/Zbot"
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony - S0453",
              "display_name": "Pony - S0453",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6522804c01930c8d2f1ad71f",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 7,
            "hostname": 403,
            "domain": 583,
            "URL": 1814,
            "FileHash-MD5": 175,
            "FileHash-SHA1": 95,
            "FileHash-SHA256": 598
          },
          "indicator_count": 3675,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "894 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6522804c01930c8d2f1ad71f",
          "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. Content reputation.",
          "description": "Unrelated websites successfully flood , and dismantle reputations, marketing efforts of targets who has and lost 100% online visibility. Cyber criminals set up malicious websites, that drive down reputation, relevant media of target. The domains are traps popular w/some hackers or malicious red team groups typically hired by attorneys.  Clicks, revenue flow to cyber criminals through malicious redirects, AGGRESSIVE social engineering, intellectual property abuse and obnoxious distraction. Contact is often made to trick target into believing their is interested in their product, body of work. Legal docs or funds may be exchange, giving cyber criminal access, email, clouds, Dropbox, forced login abuse, cloud share, phone number, C2,  payment methods, banking,  privilege to distribute, falsify ad campaigns of target. It's complicated but practices to frustrate , impoverish, profit, track, silence target. Malicious intent. Heavy tracking, core communication service swap.",
          "modified": "2023-11-07T08:04:06.581000",
          "created": "2023-10-08T10:11:22.600000",
          "tags": [
            "heur",
            "cyber threat",
            "engineering",
            "covid19",
            "united",
            "phishing site",
            "telefonica peru",
            "malicious site",
            "control server",
            "phishing",
            "suppobox",
            "malware",
            "team",
            "ransomware",
            "download",
            "facebook",
            "daum",
            "cobalt strike",
            "pony",
            "artemis",
            "simda",
            "sodinokibi",
            "zbot",
            "bank",
            "feodo",
            "laplasclipper",
            "squirrelwaffle",
            "binder",
            "virut",
            "ramnit",
            "dropper",
            "formbook",
            "azorult",
            "revil",
            "matsnu",
            "service",
            "generic",
            "malicious",
            "emotet",
            "br",
            "trojanspy",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware site",
            "blacklist",
            "alexa",
            "malicious url",
            "detection list",
            "INDICATOR ROLE TITLE DESCRIPTION EXPIRATION RELATED PULSES  URL ",
            "C2",
            "command_and_control",
            "nr-data",
            "cyber crime",
            "impersonation",
            "fraud",
            "intellectual property",
            "targets",
            "kedence",
            "song culture",
            "tsara lynn",
            "k\u00e9dence",
            "tsara",
            "tsara brashears",
            "social engineering",
            "interface exchange",
            "abuse",
            "privilege",
            "indicator",
            "file",
            "pattern match",
            "ascii text",
            "appdata",
            "windows nt",
            "script",
            "mitre att",
            "ck id",
            "show technique",
            "hybrid",
            "general",
            "local",
            "forced login",
            "content reputation",
            "reputation",
            "scheme",
            "crime",
            "cyber criminals",
            "arizona",
            "colorado",
            "newyork",
            "british",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "suricata",
            "suricata",
            "cloud",
            "device remotwd",
            "remote attack",
            "remote controlled devices",
            "tracking",
            "spyware",
            "florida",
            "united states",
            "canada",
            "estonia",
            "cyber criminal",
            "alert"
          ],
          "references": [
            "smartwishlist_1_.js",
            "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558",
            "CVE-2012-1856",
            "CVE-2013-1331",
            "CVE-2017-8570",
            "CVE-2017-0147",
            "CVE-2017-11882",
            "CVE-2017-0199",
            "CVE-2018-8453",
            "https://the.sciencebehindecommerce.com/d9core",
            "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com",
            "https://www.miraclebrand.co/apps/wonderment/tracking",
            "remote-access.net",
            "dev.remote-access.net",
            "hubspot.remote-access.net",
            "http://avient.remote-access.net/",
            "qa.remote-access.net",
            "http://www.remote-access.net",
            "https://avient.remote-access.net",
            "bam.nr-data.net",
            "appleaccessory.online",
            "init.ess.apple.com",
            "tv.apple.com",
            "http://icloud.ypcdce.com",
            "dr4qe3ddw9y32.cloudfront.net",
            "http://45.159.189.105/bot/regex",
            "http://clipper.guru/bot/regex",
            "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34",
            "cloud.smartwishlist.webmarked.net",
            "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html",
            "https://hubspot.remote-access.net",
            "icloud.ypcdce.com",
            "Research and Data analysis"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "BR",
              "display_name": "BR",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Emotet - S0367",
              "display_name": "Emotet - S0367",
              "target": null
            },
            {
              "id": "Squirrelwaffle",
              "display_name": "Squirrelwaffle",
              "target": null
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Virus:Win32/Daum",
              "display_name": "Virus:Win32/Daum",
              "target": "/malware/Virus:Win32/Daum"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Backdoor:PHP/Artemis",
              "display_name": "Backdoor:PHP/Artemis",
              "target": "/malware/Backdoor:PHP/Artemis"
            },
            {
              "id": "TEL:HackTool:Win32/ArtemisUser",
              "display_name": "TEL:HackTool:Win32/ArtemisUser",
              "target": null
            },
            {
              "id": "Azorult - S0344",
              "display_name": "Azorult - S0344",
              "target": null
            },
            {
              "id": "Feodo",
              "display_name": "Feodo",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Simda",
              "display_name": "Backdoor:Win32/Simda",
              "target": "/malware/Backdoor:Win32/Simda"
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Formbook",
              "display_name": "Formbook",
              "target": null
            },
            {
              "id": "REvil (ELF)",
              "display_name": "REvil (ELF)",
              "target": null
            },
            {
              "id": "Trojan:Win32/Matsnu",
              "display_name": "Trojan:Win32/Matsnu",
              "target": "/malware/Trojan:Win32/Matsnu"
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Zbot",
              "display_name": "Backdoor:Win32/Zbot",
              "target": "/malware/Backdoor:Win32/Zbot"
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony - S0453",
              "display_name": "Pony - S0453",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 7,
            "hostname": 403,
            "domain": 583,
            "URL": 1814,
            "FileHash-MD5": 175,
            "FileHash-SHA1": 95,
            "FileHash-SHA256": 598
          },
          "indicator_count": 3675,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "894 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f13c8ed1904a82c5615e1",
          "name": "Remcos \u2022 Communication Device exploit \u2022 C2",
          "description": "",
          "modified": "2023-10-30T02:24:08.053000",
          "created": "2023-10-30T02:24:08.053000",
          "tags": [
            "threat roundup",
            "referrer",
            "communicating",
            "ssl certificate",
            "historical ssl",
            "apple",
            "execution",
            "core",
            "ursnif",
            "hacktool",
            "remcos",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "nr-data",
            "target",
            "walker",
            "pornhub",
            "exploit",
            "issues",
            "js user"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65134045c1fc19331472ef05",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 32,
            "FileHash-SHA1": 32,
            "FileHash-SHA256": 1682,
            "URL": 4050,
            "domain": 434,
            "hostname": 678
          },
          "indicator_count": 6908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "902 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "651349817011ab7e29b7e305",
          "name": "Communication Device exploit",
          "description": "",
          "modified": "2023-10-25T04:00:03.254000",
          "created": "2023-09-26T21:13:37.864000",
          "tags": [
            "threat roundup",
            "referrer",
            "communicating",
            "ssl certificate",
            "historical ssl",
            "apple",
            "execution",
            "core",
            "ursnif",
            "hacktool",
            "remcos",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "nr-data",
            "target",
            "walker",
            "pornhub",
            "exploit",
            "issues",
            "js user"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6511134ea6ee89ec55836a41",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 32,
            "FileHash-SHA1": 32,
            "FileHash-SHA256": 1682,
            "URL": 4050,
            "domain": 434,
            "hostname": 678
          },
          "indicator_count": 6908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "907 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65134045c1fc19331472ef05",
          "name": "Remcos \u2022 Communication Device exploit \u2022 C2",
          "description": "",
          "modified": "2023-10-25T04:00:03.254000",
          "created": "2023-09-26T20:34:13.879000",
          "tags": [
            "threat roundup",
            "referrer",
            "communicating",
            "ssl certificate",
            "historical ssl",
            "apple",
            "execution",
            "core",
            "ursnif",
            "hacktool",
            "remcos",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "nr-data",
            "target",
            "walker",
            "pornhub",
            "exploit",
            "issues",
            "js user"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6511134ea6ee89ec55836a41",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 32,
            "FileHash-SHA1": 32,
            "FileHash-SHA256": 1682,
            "URL": 4050,
            "domain": 434,
            "hostname": 678
          },
          "indicator_count": 6908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "907 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6511134ea6ee89ec55836a41",
          "name": "Remcos \u2022 Communication Device exploit \u2022 C2",
          "description": "Apple iOS exploit",
          "modified": "2023-10-25T04:00:03.254000",
          "created": "2023-09-25T04:57:50.258000",
          "tags": [
            "threat roundup",
            "referrer",
            "communicating",
            "ssl certificate",
            "historical ssl",
            "apple",
            "execution",
            "core",
            "ursnif",
            "hacktool",
            "remcos",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "nr-data",
            "target",
            "walker",
            "pornhub",
            "exploit",
            "issues",
            "js user"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 32,
            "FileHash-SHA1": 32,
            "FileHash-SHA256": 1682,
            "URL": 4050,
            "domain": 434,
            "hostname": 678
          },
          "indicator_count": 6908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "907 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62802e2a51e813c6db82758f",
          "name": "Merry Christmas RUs Chasers",
          "description": "",
          "modified": "2022-06-13T00:00:32.864000",
          "created": "2022-05-14T22:33:14.346000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1727,
            "hostname": 1110,
            "URL": 4663,
            "domain": 1477,
            "CVE": 1
          },
          "indicator_count": 8978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 396,
          "modified_text": "1406 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "622a2f899031252d90bdfa73",
          "name": "GeraldWood.com ~ Mesa County Administrative Assistant",
          "description": "",
          "modified": "2022-04-09T00:00:32.009000",
          "created": "2022-03-10T17:04:09.183000",
          "tags": [
            "date",
            "server",
            "technology",
            "registrar abuse",
            "code",
            "registrar whois",
            "registry domain",
            "domain status",
            "net technology",
            "redacted for",
            "first",
            "key identifier",
            "x509v3 subject",
            "llc creation",
            "dns records",
            "record type",
            "ttl value",
            "data",
            "v3 serial"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2264,
            "hostname": 593,
            "FileHash-SHA256": 325,
            "domain": 560,
            "email": 4,
            "FileHash-SHA1": 3
          },
          "indicator_count": 3749,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 407,
          "modified_text": "1471 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "622783df0c832a8ac4d34799",
          "name": "MichaelWinn.com ~ Chief Deputy of Administration at the Harris County Texas Clerk's Office",
          "description": "",
          "modified": "2022-04-07T00:04:02.553000",
          "created": "2022-03-08T16:27:11.769000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 152,
            "URL": 503,
            "FileHash-SHA256": 257,
            "domain": 131
          },
          "indicator_count": 1043,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1473 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6221afe8395053c434e11ce3",
          "name": "RobertJudd.com ~ 2020  - 2021 SUBJECT MATTER EXPERT for Harris County Elections",
          "description": "",
          "modified": "2022-04-03T00:00:55.161000",
          "created": "2022-03-04T06:21:28.752000",
          "tags": [
            "available from",
            "date",
            "code",
            "registry tech",
            "registrar whois",
            "server",
            "registrar abuse",
            "llc creation",
            "passive dns",
            "lookups",
            "country",
            "postal code",
            "dns records",
            "record type",
            "ttl value"
          ],
          "references": [
            "https://harrisvotes.com/Docs/VotingInfo/August%202020%20Subject%20Matter%20Expert%20Public%20Report.pdf",
            "https://harrisvotes.com/Docs/VotingInfo/February%202021%20Subject%20Matter%20Expert%20Public%20Report.pdf",
            "https://harrisvotes.com/Docs/VotingInfo/August%202021%20Subject%20Matter%20Expert%20Public%20Report.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 413,
            "hostname": 67,
            "domain": 70,
            "FileHash-SHA256": 41,
            "email": 2
          },
          "indicator_count": 593,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1477 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6221ae95e75bdbc052c899f4",
          "name": "AnthonyGutierrez.com  ~ Executive Director of Common Cause Texas",
          "description": "",
          "modified": "2022-04-03T00:00:55.161000",
          "created": "2022-03-04T06:15:49.742000",
          "tags": [
            "server",
            "date",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "llc creation",
            "dns records",
            "record type",
            "ttl value",
            "data",
            "dynadot",
            "dns replication",
            "subdomains",
            "whois lookups",
            "registrant",
            "dynadot llc",
            "iana id",
            "registrar abuse"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 71,
            "URL": 363,
            "FileHash-SHA256": 142,
            "domain": 130,
            "FileHash-SHA1": 9,
            "email": 1
          },
          "indicator_count": 716,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1477 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "621e711be241bbaacb36d1a7",
          "name": "Truthsocial.com",
          "description": "",
          "modified": "2022-03-31T00:02:44.795000",
          "created": "2022-03-01T19:16:43.455000",
          "tags": [
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "aa71",
            "moved",
            "hostname ip",
            "country type",
            "entries server",
            "code",
            "false",
            "body",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1804,
            "hostname": 598,
            "domain": 372,
            "FileHash-SHA256": 1282,
            "FileHash-MD5": 2,
            "SSLCertFingerprint": 2,
            "FileHash-SHA1": 2
          },
          "indicator_count": 4062,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 407,
          "modified_text": "1480 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://avient.remote-access.net/",
        "http://www.qq664.com/seximanhua/22128.html [looks legit to me]",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "Trellis: http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT |  https://search.app.goo.gl/?ofl",
        "CVE-2017-0147",
        "Possibly false names given by individual involved. Brian Sabey Hall Render | Michael Roberts Rexxfield |  Darren Meade former partner of Roberts",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "Ransom:Win32/Haperlock.A: FileHash-SHA1 c881d1434164b35fb16107a25f84995b7fdef37f",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA256 71fa9257f88c15b438616662dc468327199edb570286c7259d333953006b8eec",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "Malware hosting: http://videolan.mirror.triple-it.nl/vlc-android/3.0.4/VLC-Android-3.0.4-ARMv7.apk",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://urlscan.io/screenshots/e40cd846-7c34-45a5-9f79-fea139f5b1ee.png",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://otx.alienvault.com/pulse/65418472eb20b10ee5510fde",
        "https://www.hallrender.com/attorney/brian-sabey",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "espysite.azurewebsites.net - https://otx.alienvault.com/indicator/hostname/espysite.azurewebsites.net",
        "Trellis: High Priority Alerts: network_icmp modifies_proxy_wpad packer_polymorphic",
        "https://crt.sh/?q=videolal.com",
        "http://us.1.powerfront.com/thehealthylivingshow/scripts/redir.asp?link=https://www.sexbestgals.info/cougar-porn/ [trellis.law]",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "remotewd.com device local",
        "False: This case was filed in Douglas County Superior Courts with Jeffrey K Holmes presiding. | Who is he?",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "https://urlscan.io/result/e4ed8a1d-1b23-46cd-a237-a2ad4e974fc3/content/",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "303 Status. Ide redirect from: https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256 aa289c89f2cdbfe896f4c77c611d94aa95858797014b57e24d5fe2bb0997d7b0",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/Makefile.auto.html",
        "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
        "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA1 fec703ee7c02ffe35c6b987bb9aac3a765e95dfb",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
        "Ransom:Win32/Haperlock.A: FileHash-MD5 46480bf46cde2b3e79852661cc5c36fc",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Tracey Richter smear included Brashears: http://video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
        "Trojan:Linux/Xorddos: FileHash-SHA256 0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "False: Brashears didn't expect this coming. Jeffrey Reimer DPT suddenly jumped on top of Brashears and tried to start a family. He didn't ask.",
        "https://otx.alienvault.com/pulse/64d018ee4623e8fcd386c2e1",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "Research and Data analysis",
        "Ransom:Win32/Tescrypt: FileHash-SHA256 916e13eb1e4313b2a04a2ae21b4955b8228183b26709a64284098ca759a8f437",
        "https://opensource.apple.com/source/security_certificates/",
        "IDS Detections: Suspicious User-Agent containing Loader Observed TLS Handshake Failure",
        "https://www.vgt.pl/favicon.ico",
        "https://crt.sh/?graph=410492573&opt=nometadata",
        "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
        "Scam Aggregators: https://trellis.law/case/8035/2017cv030026-suppressed/reimer-jeffrey-v-brashears-tsara [parked here: ctjsz.com]",
        "PWS:Win32/QQpass.B!MTB: FileHash-MD5 f7c36b4e5b4b09dc369163377aade2d7",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "CVE-2017-11882",
        "bam.nr-data.net",
        "IDS Detections : W32/Bayrob Attempted Checkin 2 CryptoWall Check-in AlphaCrypt CnC Beacon 4 Trojan-Ransom.Win32.Blocker.avsx",
        "\"Windows SMB Information Disclosure Vulnerability.\" - https://otx.alienvault.com/indicator/cve/CVE-2017-0147",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/michael.pbxuser.auto.html",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "Survivor was told an investigation would begin, she'd be safe among other careless things her MD advised",
        "Refuses to remove target from adult content \"tagging\"",
        "Trojan:Win32/Zombie.A: FileHash-SHA256 0b87667251b79cb800ddd88bdabecea8e13248c426d4a14ae0aae0ef5783f943",
        "192.124.249.187",
        "Crazy: video-lal.com/videos/michael-roberts.html",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "CnC IP's: 192.187.111.221  63.141.242.43  63.141.242.44  63.141.242.46 81.17.18.195  81.17.18.197 81.17.29.146  81.17.29.148",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Brashears smear: video-lal.com/videos/tsara-brashears-dead-by-daylight.html",
        "Trellis: 3.223.115.185 In cloud provider range: provider=AWS\t  IPv4 34.240.160.162 In cloud provider range: provider=AWS",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "icloud.ypcdce.com",
        "servicer.mgid.com \u2022 http://iv-u15.com/imbd-104-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-\u00e5\u00a4\u008f\u00e5\u00b0\u2018\u00e5\u00a5\u00b3-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-blu-ray \u2022 https://load77.exelator.com/pixel.gif",
        "Brashears would LOVE for the true court proceedings to be read. She feels they were hacked away. DougCo was unable to 'print' records 'glitch'",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA256 105834163b1a0c89e12917a3145e14be6030a611e07f7f62fa7c57de838d6251",
        "http://www.hallrender.com/attorney/brian-sabey |",
        "cloud.smartwishlist.webmarked.net",
        "appleremote.net",
        "http://www.northpoleroute.com/78985064&type=0&resid=5312625",
        "http://secure.applegiftcard.com \u2022 199.59.243.224: http://tx-p2p-pull.video-voip.com.dorm.com \u2022 199.59.243.224: http://wpad.dorm.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "Denver Attorney Frank Azar Smear: video-lal.com/videos/sherryce-emery-frank-azar-&-associates.html",
        "Trojan:Linux/Xorddos:  FileHash-SHA1 a5780498e6fce5933a7e7bf59a6fa5742e97f559",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
        "dev.remote-access.net",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA256 7456108771e6a8bac658276c1cb9e18c8c348fdd9cd3538419751c3b5ef3ac02",
        "https://prnbae.com/191693/at-37-ellie-discovers-the-unique-sensations-of-double-vaginal-sex/ [trellis.law]",
        "https://otx.alienvault.com/indicator/ip/162.222.213.199",
        "Trojan:Win32/Zombie.A: FileHash-SHA1 de974c697f0401d681e1bb3c8694a663e9e43d8f",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
        "CVE-2013-1331",
        "Unclear given names authentic. Michael Roberts, Darren Mitchell Meade , M. Brian Sabey could be used interchangeably. Black hats w/pseudonyms.",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA1 7a52b57df5b3c67f810a71dc39ff93688b141534",
        "Trojan:Linux/Xorddos: FileHash-MD5 3b4ce1333614cd21c109054630e959b9",
        "Reimers case V Brashears in 2017 after Denver Police Major Crimes located Reimer",
        "https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "https://harrisvotes.com/Docs/VotingInfo/August%202021%20Subject%20Matter%20Expert%20Public%20Report.pdf",
        "http://islamicsoftwares.com/downloads/iphone/audioCont/2/107.tar.gz http://islamicsoftwares.com/downloads/iphone/audioCont/7/110.tar.gz",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
        "Trojan:Win32/Zombie.A: FileHash-MD5 34e85820b41c14e07dd564f22997e893",
        "There is NO other physical therapist with as many reviews as Jeffrey Reimer DPT, even non offenders. Reimers clientele is largely non-english speaking.",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
        "Case: Defamation of character based on truthful reviews left on HealthGrades.",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA1 57486d33246bce6dfedb0836cd97c9acd4a4a39a",
        "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
        "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "Brashears documented on corr record she wanted to proceed with case",
        "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA256 4e692806955f9ee3f4c7a5d9a1ac7729eb53b855b39e6f9f943f89ccba30bd49",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "videolal.com [Exploitation for privilege - Turns victim into target then spys, smears, embeds pornography in devices]",
        "https://crt.sh/?spkisha256=2c5ef644a15ed2d591aee707a125b2870da480a0bc16d78022a311c93aca5b15",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "Ransomware: message.htm.com",
        "https://www.paidhmars.com/",
        "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
        "IDS Detections : AlphaCrypt CnC Beacon 3 MalDoc Request for Payload Aug 17 2016 Koobface W32/Bayrob Attempted Checkin",
        "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
        "dr4qe3ddw9y32.cloudfront.net",
        "http://security.didici.cc/cve",
        "https://otx.alienvault.com/pulse/65a342310ab3d2c69778d608",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
        "brain-portal.net",
        "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe | smithsthermopadtool.com",
        "IDS Detections: W32/Bayrob Attempted Checkin 2 Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin",
        "Victim is willing to have her attorney post entire court proceedings online , on YouTube and more",
        "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
        "Trellis: https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34",
        "Alerts: cape_detected_threat cape_extracted_content",
        "CVE-2017-8570",
        "Jeffrey Scott Reimer DPT was allegedly arrested 02/14/2022 |  Very unreliable self proclaimed PI's (multiple)",
        "http://clipper.guru/bot/regex",
        "Darren Meade: https://urlscan.io/result/e5f1d6fe-036e-4291-8595-0a33e5dacba5/#behaviour \u2022 alleged partner turned enemy of Michael Roberts",
        "http://usb.smithtech.us  \u2022 http://usb.smithtech.us/apps/downloads/NSISPortable.exe \u2022 http://usb.smithtech.us/apps/downloads/xplorer2.lite.portable.exe",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "https://otx.alienvault.com/indicator/file/251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "Trellis:TrojanDownloader:Win32/Upatre.A  | Yara Detections Upack_all_versions",
        "Backdoor:Win32/Fynloski.A: FileHash-MD5 c3113684e8f8aa6d1b1b67d59141e845",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "https://hubspot.remote-access.net",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
        "TrojanClicker:Win32/Ellell.A: 4d3e7d486ec5918d91e54e51c4d07dc6",
        "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "Jeffrey Scott Reimer PT , DPT. assaulters defense: 'I had to be of the top/front of Brashears, She consented!'",
        "video-lal.com/videos/sandra-richter-video.html",
        "Judge Shay Whittaker dismissed Reimers 'malicious' prosecution claom",
        "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/pulse/64d65255c80d866add600bac",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/project.pbxproj.auto.html",
        "http://45.159.189.105/bot/regex",
        "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "Win.Virus.TeslaCrypt3-2: 78af1fd5be62ab829e49f9a1b5fbb8a9b30f8d0804cba5805c8f350b841d522e",
        "Responsible reopening Richter case via alleged Detective Ben Smith | Names Below  linked to porn spewing Videolan , Videolal, Video-lal (Honeypots?) |",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
        "init.ess.apple.com",
        "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "Did I mention she prevailed, won, got a check? Tsara Lynn Brashears survivor; won her counter claim. Weak Reimer claim burned like a dying moth.",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://avient.remote-access.net",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "http://www.philippinesredcat.com/girls-for-sex-in-manila/ [trellis.law]",
        "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
        "Antivirus Detections: ELF:Xorddos-AE\\ [Trj] ,  Unix.Trojan.Xorddos-1 ,",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.searchw3.com/",
        "https://help.competitionsuite.com/article/76-using-the-judge-app-tablets",
        "Brian Sabey had cashiers check delivered to Brashears in person.",
        "Brian Sabey Speaking for Jeffrey Scott Reimer DPT refused further court proceedings",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "notonmytrack.info \u2022 http://notonmytrack.info \u2022 https://pochta-rf.ru/track74157857 \u2022 patch-tracker.gnewsense.org \u2022 mysql.snore.co",
        "Tracey Richter smear:  video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
        "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "CVE-2017-0199",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "hubspot.remote-access.net",
        "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
        "qa.remote-access.net",
        "appleaccessory.online",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "https://hallrender.com/attorney/brian-sabey",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
        "http://tx-p2p-pull.video-voip.com.dorm.com/Accept-Language",
        "A series of reviews detailing Jeffrey Reimer DPT egregious behavior proved not left by Brashears except 2 with comments -4",
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe \u2022",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
        "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "https://the.sciencebehindecommerce.com/d9core",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://otx.alienvault.com/indicator/ip/185.230.63.186",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "PWS:Win32/Ymacco.AA50: FileHash-MD5 5739cd62eb88e2a7e514784fe7cf5ca4",
        "Brian Sabey offered Brashears a settlement. Begged her to accept it.",
        "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "https://otx.alienvault.com/indicator/ip/63.141.242.45",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA 453355033bb7977831ca87cc90156b594f13b2ee",
        "Health Grades erased 20+ positive reviews that originated from Reimers email address.",
        "Unless tampered with, court records will show Brashears dropped as a patient to be told she'd face legal consequences if she did.",
        "Trellis: www.youtube.com/watch?v=GyuMozsVyYs \t\u00bb Survivors video references assault. Does not name or depict Reimers likeness.",
        "smartwishlist_1_.js",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
        "remote-access.net",
        "Trellis: Hostname blockpage.bt.com | hdredirect-lb7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com | itunes.apple.com | search.app.goo.gl  | www.youtube.com",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
        "Brashears Review: 'He would benefit from more training' [Very considerate considering the complimentary spinal cord injuries 'plural']",
        "Tracey Richter smear:  video-lal.com/videos/diabolical-sentencing.html",
        "FormBook",
        "Brian Sabey. Esq filed motion to dismiss after judge dismissed Reimers meritlesscase",
        "IDS Detections : Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "sex2e.com  | http://qq664.com/seximanhua/22128.html [trellis.law]",
        "https://otx.alienvault.com/pulse/65204565ac1e8bce4de26df3",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png | www.hallrender.com | rexxfield.com",
        "http://usb.smithtech.us/projects/downloads/\u2022 http://usb.smithtech.us/projects/downloads/psu.exe \u2022 smithsthermopadtool.com",
        "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
        "CVE-2012-1856",
        "IDS Detections: Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "Smith tech may refer to Det. Ben Smith. HallRender; a media company, producing nonsensical, albeit convincing evidence of deeply fake content.",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "Brian Sabey begged victim to accept tiny settlement. Contingency, 'Brashears may use  settlement to find hacker.'",
        "IDS Detections: Downloader (P2P Zeus dropper UA) Common Upatre Header Structure 2 Upatre Retrieving encoded payload (Common Header Struct)",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/",
        "tv.apple.com",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "smartphonesonline.co.uk  https://smartphonesonline.co.uk/  https://www.smartphonesonline.co.uk/ [192.187.111.222. US - Request HTTP -Target IP]",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "Yara Detections: is__elf ,  xorddos ,  LinuxXorDDoS_VariantTwo",
        "http://icloud.ypcdce.com",
        "Brian Sabey wanted to appear to win. Sandy demanded Brashears remove every patients negative review about Jeffrey Reimer DPT",
        "http://www.remote-access.net",
        "Ransom:Win32/Haperlock.A; FileHash-SHA256 8264c73f129d4895573c2375ea4e4636b9d5df66852ce72ccc20d31a96ae7df1",
        "https://harrisvotes.com/Docs/VotingInfo/February%202021%20Subject%20Matter%20Expert%20Public%20Report.pdf",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "IP\u2019s Contacted: 192.124.249.187",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "Trellis: secure04-appleid.com | http://secure04-appleid.com | cpcalendars.secure04-appleid.com",
        "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
        "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "videolal.com was first found hosted : https://rexxfield.com/ | https://crt.sh/?id=410492573 | https://crt.sh/?id=411260982",
        "Most of not all  positive Jeffrey Reimer DPT reviews are false.  Reimer wasn't practicing when 'amazing' trat,ent alleged",
        "https://www.miraclebrand.co/apps/wonderment/tracking",
        "Brian Sabey would  be most foolish after it was determined Brashears was 100% disabled. This was cause by Jeffrey Scott Reimer DPT",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/roots/",
        "https://harrisvotes.com/Docs/VotingInfo/August%202020%20Subject%20Matter%20Expert%20Public%20Report.pdf",
        "CVE-2018-8453",
        "He also spoke frequently about Brashears infamously 'real' large bosom and figure. He decided to touch, grab, grope, assault,injure, beg for more",
        "Sabey: https://www.google.com/search?q=tsara+brashears&client=ms-android-tmus-us-rvc3&sca_esv=52c806ab62ec5c59&cs=1&prmd=inv&filter=0&biw=347&bih=710&dpr=2.08#ip=1",
        "http://watchhers.net/index.php",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "Reimer often criticized non English speakers, large women and short Hispanic men according to witness.",
        "Mercenary Attackers / Cellebrite branded as: http://teacellertea.com/Pegasus/ NSO",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
        "Brashears would gladly go to court as stated in court documents to then judge who wished to be briefed by Brashears. Thwarted by Sabey.",
        "TrojanDownloader:Win32/PurityScan.MI!MTB: FileHash-SHA1 58ba8715a88d883537ba8d0e20eea2a4d9269cad",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "Tracey Richter smear: video-lal.com/video/fbcwPGTSo5lrA7e/tracey-richter-documentary?cpc=no",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "False: Never served. Had several PI's and background checks"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "[Unnamed group]",
            "Parking Crew"
          ],
          "malware_families": [
            "Worm:win32/autorun",
            "Pegasus for android - mob-s0032",
            "Emotet - s0367",
            "Trojanspy",
            "Virus.virlock/nabucur",
            "W32.eheur",
            "Dridex",
            "Sakula rat",
            "Feodo",
            "Pony - s0453",
            "Ramnit",
            "Win.trojan.knigsfot-125",
            "Trojanspy:win32/nivdort.de",
            "Bayrob",
            "Nymaim",
            "Pws:win32/qqpass.b!mtb",
            "Trojan:win32/zombie.a",
            "Win32:trojanx-gen[trj]",
            "Solar",
            "Tv rat",
            "Backdoor:win32/zbot",
            "Trojan.avsetecer",
            "Tofsee",
            "I-worm/bagle.qe",
            "Trojan:win32/matsnu",
            "Worm:win32/pykspa",
            "Backdoor:php/artemis",
            "Formbook",
            "Tel:exploit:win32/sinkers",
            "Pony",
            "Trojanspy:win32/nivdort",
            "Trojanspy:win32/nivdort.cw",
            "Mydoom",
            "Virus:win32/daum",
            "Backdoor:win32/simda",
            "Dyre",
            "Maltiverse",
            "Br",
            "Trojan:win32/qshell",
            "Backdoor:win32/fynloski.a",
            "Trojan:linux/xorddos",
            "Laplasclipper",
            "Adware.browsefox",
            "Trojan:win32/zbot.sibg3!mtb",
            "P2p zeus - s0016",
            "Win.malware.farfli-6824119-0",
            "Locky (decryptor)",
            "Trojan.wisdomeyes.16070401.9500",
            "Gen:variant.strictor",
            "Hacktool",
            "Pykspa_v2_fake",
            "Kryptik",
            "Pykspa",
            "Trojandownloader:win32/upatre.a",
            "Cobalt strike",
            "Win.adware.relevantknowledge-9821121-0",
            "Alf:trojandownloader:win32/vadokrist.a",
            "Azorult - s0344",
            "Hallrender",
            "Tel:hacktool:win32/artemisuser",
            "Defacement",
            "Suppobox",
            "Ransomware",
            "Pws:win32/ymacco.aa50",
            "Trojanclicker:win32/ellell.a",
            "Squirrelwaffle",
            "Artro",
            "Revil (elf)",
            "Win32:crypterx-gen\\ [trj]",
            "Redline",
            "Alf:heraklezeval:trojan:win32/neurevt",
            "Banjori",
            "Sabey",
            "Zbot",
            "Msil_kryptik.p.gen",
            "Win.trojan.generic-9897526-0",
            "Virut",
            "Ransom:win32/haperlock.a",
            "Win.trojan.generic-9957168-0",
            "Locky",
            "Pegasus for ios - s0289",
            "Cl0p",
            "Win.virus.teslacrypt3-2/custom",
            "Generic",
            "Ransom:win32/tescrypt",
            "Other:malware-gen\\ [trj]",
            "Elocky",
            "Win32.renos/artro",
            "Worm.bagle-44",
            "Trojan:win32/mydoom",
            "Jaik",
            "Zeus"
          ],
          "industries": [
            "Health",
            "Telecommunications",
            "Research",
            "Civilians",
            "Technology"
          ],
          "unique_indicators": 201388
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/venexus.com",
    "whois": "http://whois.domaintools.com/venexus.com",
    "domain": "venexus.com",
    "hostname": "mx0.venexus.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 46,
  "pulses": [
    {
      "id": "69b49ad5dd40a24d83cd6a72",
      "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-03-13T23:16:37.716000",
      "created": "2026-03-13T23:16:37.716000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69631fbd16e306ee2b76c4da",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "37 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b496396ca4987e95ad37d1",
      "name": "Chris Buzz by QVashni (wow)",
      "description": "",
      "modified": "2026-03-13T22:56:57.314000",
      "created": "2026-03-13T22:56:57.314000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69482caa00d327da8f0a87bc",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "37 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b49587dd104e342dda1628",
      "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
      "description": "",
      "modified": "2026-03-13T22:53:59.112000",
      "created": "2026-03-13T22:53:59.112000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "37 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69631fbd16e306ee2b76c4da",
      "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2026-01-11T03:57:49.242000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "695557ee134b978b00883c29",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695557ee134b978b00883c29",
      "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-31T17:05:50.134000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69482caa00d327da8f0a87bc",
      "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-21T17:21:46.434000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "691f4d4ef0a2a570b8b21cd2",
      "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
      "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-11-20T17:18:06.929000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68743733a69ce827f6156f5c",
      "name": "W3.org | Google Spy engine | Tracking, Malware Repository | www.W3.org https://www.searchw3.com/ > ww.google.com.uy",
      "description": "",
      "modified": "2025-07-13T22:46:11.685000",
      "created": "2025-07-13T22:46:11.685000",
      "tags": [
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "expired",
        "acceptencoding",
        "html info",
        "title home",
        "tags viewport",
        "trackers google",
        "tag manager",
        "gsddf3d2bzf",
        "historical ssl",
        "referrer",
        "december",
        "formbook",
        "round",
        "apple ios",
        "tsara brashears",
        "unlocker",
        "collection",
        "vt graph",
        "socgholish",
        "blister",
        "hacktool",
        "hiddentear",
        "gootloader",
        "agent tesla",
        "crypto",
        "installer",
        "life",
        "malware",
        "open",
        "korplug",
        "tofsee",
        "date",
        "name servers",
        "status",
        "passive dns",
        "urls",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "files",
        "no data",
        "tag count",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "heur",
        "cisco umbrella",
        "alexa top",
        "million",
        "site",
        "alexa",
        "maltiverse",
        "xcnfe",
        "safe site",
        "phishing",
        "remcos",
        "malicious",
        "miner",
        "bank",
        "agenttesla",
        "agent",
        "unknown",
        "downloader",
        "unsafe",
        "trojan",
        "detplock",
        "artemis",
        "networm",
        "win64",
        "redline stealer",
        "limerat",
        "venom rat",
        "trojanspy",
        "tld count",
        "png image",
        "jpeg image",
        "rgba",
        "exif standard",
        "tiff image",
        "pattern match",
        "ascii text",
        "united",
        "jfif",
        "sha1",
        "core",
        "general",
        "starfield",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "adobea",
        "daga",
        "as30148 sucuri",
        "td tr",
        "search",
        "span td",
        "as44273 host",
        "creation date",
        "a domains",
        "xtra",
        "meta",
        "back",
        "verdict",
        "domain",
        "aaaa",
        "as15169 google",
        "asnone united",
        "nxdomain",
        "sucuri security",
        "a li",
        "span",
        "class",
        "body",
        "sucuri website",
        "a div",
        "authority",
        "record value",
        "showing",
        "gmt content",
        "x sucuri",
        "high",
        "related pulses",
        "show",
        "guard",
        "entries",
        "win32",
        "west domains",
        "next",
        "ipv4",
        "asnone germany",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "formbook cnc",
        "checkin",
        "found",
        "error",
        "code",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "dock",
        "execution",
        "copy",
        "xport",
        "firewall",
        "body doctype",
        "section",
        "dcrat",
        "analyzer paste",
        "iocs",
        "hostnames",
        "url https",
        "blacklist",
        "cl0p ransomware",
        "zbot",
        "malware site",
        "team memscan",
        "cl0p",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus starizona",
        "cngo daddy",
        "g2 validity",
        "subject public",
        "key info",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "as174",
        "as3257",
        "sucuri",
        "sucur2",
        "verisign",
        "whois database",
        "server",
        "registrar abuse",
        "icann whois",
        "whois status",
        "registrar iana",
        "form",
        "temple",
        "first",
        "android",
        "win32 exe",
        "html",
        "bobby fischer",
        "office open",
        "detections type",
        "name",
        "pdf dealer",
        "price list",
        "pdf my",
        "crime",
        "taiwan unknown",
        "as3462",
        "as131148 bank",
        "as21342",
        "all search",
        "otx scoreblue",
        "pulse pulses",
        "cname",
        "as22612",
        "as43350 nforce",
        "win32upatre jun",
        "expiration date",
        "hostname",
        "lowfi",
        "date hash",
        "avast avg",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jun",
        "files show",
        "registrar",
        "china unknown",
        "title",
        "network",
        "fakedout threat",
        "urls http",
        "maltiverse safe",
        "malicious url",
        "team",
        "phishtank",
        "services",
        "botnet command",
        "control server",
        "mining",
        "betabot",
        "team malware",
        "engineering",
        "stealer",
        "service",
        "vawtrak",
        "virut",
        "emotet",
        "simda",
        "redline",
        "fri oct",
        "media sharing",
        "known infection source",
        "bot networks",
        "malware",
        "malware repository",
        "spyware"
      ],
      "references": [
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "IP\u2019s Contacted: 192.124.249.187",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6688e0ffb31d4881f3238713",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4080,
        "URL": 11952,
        "hostname": 4638,
        "domain": 4301,
        "FileHash-MD5": 2236,
        "FileHash-SHA1": 1140,
        "CVE": 8,
        "SSLCertFingerprint": 20,
        "email": 8,
        "CIDR": 1
      },
      "indicator_count": 28384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "280 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66804428b487338dc16f70a7",
      "name": "Brian Sabey Orbiting Tsara Brashears and associates | Espionage | Said client: Jeffrey Reimer",
      "description": "Brian Sabey & large team continue excessive orbiting target & family members in multiple states. \nUnwarranted, dangerous and illegal. \nLarge attacks have wreaked havoc on medical establishments, targets medical profile, once profitable business, legal manipulation, financial well being. forced poverty, swatting, imfostealer, insurance fraud, intellectual property use, Audi le spying, in person stalking, confrontations, great bodily harm, loss of peace, safety. basic human rights and privacy, phone call redirection, malvertising. In the name of assaulter Jeffrey Scott Reimer",
      "modified": "2024-11-05T10:00:12.606000",
      "created": "2024-06-29T17:28:08.283000",
      "tags": [
        "unknown",
        "united",
        "virgin islands",
        "as51852",
        "as33387",
        "as19905",
        "as44273 host",
        "cname",
        "nxdomain",
        "passive dns",
        "url http",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "entries",
        "urls",
        "files ip",
        "address domain",
        "ip related",
        "pulses otx",
        "pulses",
        "related tags",
        "indicator facts",
        "dga domain",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "pulse pulses",
        "ip address",
        "related nids",
        "log id",
        "gmtn",
        "go daddy",
        "authority",
        "tls web",
        "arizona",
        "scottsdale",
        "ca issuers",
        "b59bn timestamp",
        "ff2c217402202b",
        "code",
        "false",
        "url https",
        "domain",
        "trojan",
        "hostname",
        "files",
        "body",
        "date",
        "path max",
        "age86400 set",
        "cookie",
        "script urls",
        "type",
        "mtb may",
        "script script",
        "trojanspy",
        "striven",
        "miles2",
        "rexxfield",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "date sat",
        "gmt server",
        "sakula malware",
        "historical ssl",
        "realteck audio",
        "lemon duck",
        "iocs",
        "tsara brashears",
        "loki password",
        "stealer",
        "windows",
        "auction",
        "metro",
        "core",
        "colibri loader",
        "hacktool",
        "status",
        "for privacy",
        "creation date",
        "record value",
        "name servers",
        "showing",
        "next",
        "mtb mar",
        "ipv4",
        "ransom",
        "west domains",
        "redacted for",
        "gmt location",
        "gmt max",
        "cowboy",
        "encrypt",
        "as60558 phoenix",
        "susp",
        "win32",
        "methodpost",
        "canada unknown",
        "as43350 nforce",
        "united kingdom",
        "as47846",
        "germany unknown",
        "briansabey",
        "body doubles",
        "orbiters",
        "malvertising",
        "cane",
        "get na",
        "show",
        "as16509",
        "delete c",
        "sinkhole cookie",
        "value snkz",
        "cape",
        "possible",
        "copy",
        "nivdort",
        "write",
        "bayrob",
        "malware",
        "exploit",
        "confirm https",
        "impact",
        "misc http",
        "cvss v2",
        "authentication",
        "n cvss",
        "v3 severity",
        "high attack",
        "emails",
        "cnc",
        "alphacrypt cnc",
        "beacon",
        "as15169 google",
        "limited",
        "as8560",
        "elite",
        "AS33387 nocix llc",
        "pegasus",
        "mercenary",
        "cellerebrand",
        "cellebrite",
        "apple",
        "dark",
        "apple ios",
        "ios",
        "apple iphone",
        "apple itunes",
        "itunes",
        "pegasystem",
        "data brokers",
        "hackers",
        "javascript",
        "please",
        "intel",
        "filehash",
        "av detections",
        "xorddos"
      ],
      "references": [
        "http://www.northpoleroute.com/78985064&type=0&resid=5312625",
        "espysite.azurewebsites.net - https://otx.alienvault.com/indicator/hostname/espysite.azurewebsites.net",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256 aa289c89f2cdbfe896f4c77c611d94aa95858797014b57e24d5fe2bb0997d7b0",
        "Ransom:Win32/Haperlock.A: FileHash-MD5 46480bf46cde2b3e79852661cc5c36fc",
        "Ransom:Win32/Haperlock.A: FileHash-SHA1 c881d1434164b35fb16107a25f84995b7fdef37f",
        "Ransom:Win32/Haperlock.A; FileHash-SHA256 8264c73f129d4895573c2375ea4e4636b9d5df66852ce72ccc20d31a96ae7df1",
        "IDS Detections: W32/Bayrob Attempted Checkin 2 Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin",
        "IDS Detections: Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "Alerts: cape_detected_threat cape_extracted_content",
        "https://otx.alienvault.com/indicator/file/251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "\"Windows SMB Information Disclosure Vulnerability.\" - https://otx.alienvault.com/indicator/cve/CVE-2017-0147",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA256 4e692806955f9ee3f4c7a5d9a1ac7729eb53b855b39e6f9f943f89ccba30bd49",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA 453355033bb7977831ca87cc90156b594f13b2ee",
        "Backdoor:Win32/Fynloski.A: FileHash-MD5 c3113684e8f8aa6d1b1b67d59141e845",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA256 7456108771e6a8bac658276c1cb9e18c8c348fdd9cd3538419751c3b5ef3ac02",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA1 7a52b57df5b3c67f810a71dc39ff93688b141534",
        "TrojanClicker:Win32/Ellell.A: 4d3e7d486ec5918d91e54e51c4d07dc6",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA256 105834163b1a0c89e12917a3145e14be6030a611e07f7f62fa7c57de838d6251",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA1 57486d33246bce6dfedb0836cd97c9acd4a4a39a",
        "PWS:Win32/Ymacco.AA50: FileHash-MD5 5739cd62eb88e2a7e514784fe7cf5ca4",
        "https://otx.alienvault.com/indicator/ip/162.222.213.199",
        "TrojanDownloader:Win32/PurityScan.MI!MTB: FileHash-SHA1 58ba8715a88d883537ba8d0e20eea2a4d9269cad",
        "Ransom:Win32/Tescrypt: FileHash-SHA256 916e13eb1e4313b2a04a2ae21b4955b8228183b26709a64284098ca759a8f437",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA256 71fa9257f88c15b438616662dc468327199edb570286c7259d333953006b8eec",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA1 fec703ee7c02ffe35c6b987bb9aac3a765e95dfb",
        "PWS:Win32/QQpass.B!MTB: FileHash-MD5 f7c36b4e5b4b09dc369163377aade2d7",
        "Trojan:Win32/Zombie.A: FileHash-SHA256 0b87667251b79cb800ddd88bdabecea8e13248c426d4a14ae0aae0ef5783f943",
        "Trojan:Win32/Zombie.A: FileHash-SHA1 de974c697f0401d681e1bb3c8694a663e9e43d8f",
        "Trojan:Win32/Zombie.A: FileHash-MD5 34e85820b41c14e07dd564f22997e893",
        "Win.Virus.TeslaCrypt3-2: 78af1fd5be62ab829e49f9a1b5fbb8a9b30f8d0804cba5805c8f350b841d522e",
        "IDS Detections : W32/Bayrob Attempted Checkin 2 CryptoWall Check-in AlphaCrypt CnC Beacon 4 Trojan-Ransom.Win32.Blocker.avsx",
        "IDS Detections : AlphaCrypt CnC Beacon 3 MalDoc Request for Payload Aug 17 2016 Koobface W32/Bayrob Attempted Checkin",
        "IDS Detections : Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "https://otx.alienvault.com/indicator/ip/185.230.63.186",
        "CnC IP's: 192.187.111.221  63.141.242.43  63.141.242.44  63.141.242.46 81.17.18.195  81.17.18.197 81.17.29.146  81.17.29.148",
        "http://islamicsoftwares.com/downloads/iphone/audioCont/2/107.tar.gz http://islamicsoftwares.com/downloads/iphone/audioCont/7/110.tar.gz",
        "smartphonesonline.co.uk  https://smartphonesonline.co.uk/  https://www.smartphonesonline.co.uk/ [192.187.111.222. US - Request HTTP -Target IP]",
        "Mercenary Attackers / Cellebrite branded as: http://teacellertea.com/Pegasus/ NSO",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "https://otx.alienvault.com/indicator/ip/63.141.242.45",
        "Yara Detections: is__elf ,  xorddos ,  LinuxXorDDoS_VariantTwo",
        "Antivirus Detections: ELF:Xorddos-AE\\ [Trj] ,  Unix.Trojan.Xorddos-1 ,",
        "Trojan:Linux/Xorddos: FileHash-MD5 3b4ce1333614cd21c109054630e959b9",
        "Trojan:Linux/Xorddos:  FileHash-SHA1 a5780498e6fce5933a7e7bf59a6fa5742e97f559",
        "Trojan:Linux/Xorddos: FileHash-SHA256 0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "https://hallrender.com/attorney/brian-sabey"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort.CW",
          "display_name": "TrojanSpy:Win32/Nivdort.CW",
          "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
        },
        {
          "id": "Ransom:Win32/Haperlock.A",
          "display_name": "Ransom:Win32/Haperlock.A",
          "target": "/malware/Ransom:Win32/Haperlock.A"
        },
        {
          "id": "Backdoor:Win32/Fynloski.A",
          "display_name": "Backdoor:Win32/Fynloski.A",
          "target": "/malware/Backdoor:Win32/Fynloski.A"
        },
        {
          "id": "TrojanClicker:Win32/Ellell.A",
          "display_name": "TrojanClicker:Win32/Ellell.A",
          "target": "/malware/TrojanClicker:Win32/Ellell.A"
        },
        {
          "id": "Bayrob",
          "display_name": "Bayrob",
          "target": null
        },
        {
          "id": "Win.Virus.TeslaCrypt3-2/Custom",
          "display_name": "Win.Virus.TeslaCrypt3-2/Custom",
          "target": null
        },
        {
          "id": "PWS:Win32/Ymacco.AA50",
          "display_name": "PWS:Win32/Ymacco.AA50",
          "target": "/malware/PWS:Win32/Ymacco.AA50"
        },
        {
          "id": "Ransom:Win32/Tescrypt",
          "display_name": "Ransom:Win32/Tescrypt",
          "target": "/malware/Ransom:Win32/Tescrypt"
        },
        {
          "id": "PWS:Win32/QQpass.B!MTB",
          "display_name": "PWS:Win32/QQpass.B!MTB",
          "target": "/malware/PWS:Win32/QQpass.B!MTB"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Pegasus for iOS - S0289",
          "display_name": "Pegasus for iOS - S0289",
          "target": null
        },
        {
          "id": "Pegasus for Android - MOB-S0032",
          "display_name": "Pegasus for Android - MOB-S0032",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Trojan:Linux/Xorddos",
          "display_name": "Trojan:Linux/Xorddos",
          "target": "/malware/Trojan:Linux/Xorddos"
        },
        {
          "id": "Sakula RAT",
          "display_name": "Sakula RAT",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 106,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3885,
        "hostname": 1651,
        "URL": 5981,
        "FileHash-MD5": 486,
        "FileHash-SHA256": 3859,
        "SSLCertFingerprint": 2,
        "FileHash-SHA1": 487,
        "CVE": 7,
        "email": 8
      },
      "indicator_count": 16366,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "530 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d490668683aec2631cfa20",
      "name": "Jeffrey Reimer DPT Tsara Brashears Court Records | Trellis.Law",
      "description": "Phishing expedition: Malicious bait. Threat actor/s attempting to hack whoever can see and clicks on link. The URl is parked, is malicious, attempts infiltrate device.",
      "modified": "2024-11-05T00:02:43.336000",
      "created": "2024-09-01T16:03:50.411000",
      "tags": [
        "reimer-jeffrey-v-brashears-tsara",
        "2017cv030026  suppressed",
        "case 2017cv030026  suppressed",
        "docket",
        "legal case",
        "legal",
        "litigation",
        "court cases",
        "state court docket",
        "robert r",
        "lung",
        "county",
        "case",
        "money",
        "ben l",
        "leutwyler iii",
        "reimer",
        "brashears",
        "douglas county",
        "tips",
        "district",
        "date",
        "judge",
        "shane",
        "bank",
        "contact",
        "service",
        "brashears accepts",
        "jeffrey scott",
        "reimer dpt",
        "reimer paid",
        "sa victim",
        "settlement",
        "reimer-jeffrey-paid-tsara-brahears-settlement",
        "reimer-jeffrey-claim-dismissed",
        "brashears-tsara-claims-upheld",
        "reverse dns",
        "general full",
        "protocol h2",
        "security tls",
        "resource",
        "united",
        "hash",
        "name value",
        "security",
        "main",
        "facebook",
        "brashears-tsara-v-reimer-jeffrey",
        "so false",
        "as134548 dxtl",
        "kwan o",
        "hong kong",
        "passive dns",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "export graph",
        "historical ssl",
        "referrer",
        "gameprofitshack",
        "webstudio",
        "smartdata",
        "alloymedia",
        "industries",
        "theakkas",
        "korplug",
        "default",
        "module load",
        "t1129",
        "show",
        "search",
        "regbinary",
        "malware beacon",
        "upatre",
        "suspicious",
        "trojan",
        "copy",
        "dock",
        "downloader",
        "loader",
        "write",
        "malware",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "related pulses",
        "dashboard",
        "browse scan",
        "endpoints all",
        "showing",
        "p2p zeus",
        "september",
        "popper",
        "cookies",
        "x function",
        "hsp boolean",
        "oribili boolean",
        "hstcran",
        "hsusertoken",
        "domainpath name",
        "ns nxdomain",
        "parked",
        "tsara won",
        "brashears prevails",
        "reimer dismissal",
        "dangerous data collection",
        "get device",
        "parked uri"
      ],
      "references": [
        "Scam Aggregators: https://trellis.law/case/8035/2017cv030026-suppressed/reimer-jeffrey-v-brashears-tsara [parked here: ctjsz.com]",
        "http://www.qq664.com/seximanhua/22128.html [looks legit to me]",
        "sex2e.com  | http://qq664.com/seximanhua/22128.html [trellis.law]",
        "https://prnbae.com/191693/at-37-ellie-discovers-the-unique-sensations-of-double-vaginal-sex/ [trellis.law]",
        "http://www.philippinesredcat.com/girls-for-sex-in-manila/ [trellis.law]",
        "http://us.1.powerfront.com/thehealthylivingshow/scripts/redir.asp?link=https://www.sexbestgals.info/cougar-porn/ [trellis.law]",
        "https://help.competitionsuite.com/article/76-using-the-judge-app-tablets",
        "https://www.paidhmars.com/",
        "https://urlscan.io/result/e4ed8a1d-1b23-46cd-a237-a2ad4e974fc3/content/",
        "False: This case was filed in Douglas County Superior Courts with Jeffrey K Holmes presiding. | Who is he?",
        "False: Never served. Had several PI's and background checks",
        "Jeffrey Scott Reimer DPT was allegedly arrested 02/14/2022 |  Very unreliable self proclaimed PI's (multiple)",
        "Brian Sabey begged victim to accept tiny settlement. Contingency, 'Brashears may use  settlement to find hacker.'",
        "Judge Shay Whittaker dismissed Reimers 'malicious' prosecution claom",
        "Reimers case V Brashears in 2017 after Denver Police Major Crimes located Reimer",
        "Brashears documented on corr record she wanted to proceed with case",
        "Brian Sabey Speaking for Jeffrey Scott Reimer DPT refused further court proceedings",
        "Brian Sabey offered Brashears a settlement. Begged her to accept it.",
        "Case: Defamation of character based on truthful reviews left on HealthGrades.",
        "A series of reviews detailing Jeffrey Reimer DPT egregious behavior proved not left by Brashears except 2 with comments -4",
        "Brashears Review: 'He would benefit from more training' [Very considerate considering the complimentary spinal cord injuries 'plural']",
        "Health Grades erased 20+ positive reviews that originated from Reimers email address.",
        "Most of not all  positive Jeffrey Reimer DPT reviews are false.  Reimer wasn't practicing when 'amazing' trat,ent alleged",
        "Brian Sabey. Esq filed motion to dismiss after judge dismissed Reimers meritlesscase",
        "Brian Sabey would  be most foolish after it was determined Brashears was 100% disabled. This was cause by Jeffrey Scott Reimer DPT",
        "Brashears would gladly go to court as stated in court documents to then judge who wished to be briefed by Brashears. Thwarted by Sabey.",
        "Brian Sabey wanted to appear to win. Sandy demanded Brashears remove every patients negative review about Jeffrey Reimer DPT",
        "Brian Sabey had cashiers check delivered to Brashears in person.",
        "Victim is willing to have her attorney post entire court proceedings online , on YouTube and more",
        "There is NO other physical therapist with as many reviews as Jeffrey Reimer DPT, even non offenders. Reimers clientele is largely non-english speaking.",
        "Reimer often criticized non English speakers, large women and short Hispanic men according to witness.",
        "He also spoke frequently about Brashears infamously 'real' large bosom and figure. He decided to touch, grab, grope, assault,injure, beg for more",
        "Jeffrey Scott Reimer PT , DPT. assaulters defense: 'I had to be of the top/front of Brashears, She consented!'",
        "False: Brashears didn't expect this coming. Jeffrey Reimer DPT suddenly jumped on top of Brashears and tried to start a family. He didn't ask.",
        "Unless tampered with, court records will show Brashears dropped as a patient to be told she'd face legal consequences if she did.",
        "Survivor was told an investigation would begin, she'd be safe among other careless things her MD advised",
        "Brashears would LOVE for the true court proceedings to be read. She feels they were hacked away. DougCo was unable to 'print' records 'glitch'",
        "Did I mention she prevailed, won, got a check? Tsara Lynn Brashears survivor; won her counter claim. Weak Reimer claim burned like a dying moth.",
        "Trellis: 3.223.115.185 In cloud provider range: provider=AWS\t  IPv4 34.240.160.162 In cloud provider range: provider=AWS",
        "Trellis: http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT |  https://search.app.goo.gl/?ofl",
        "Trellis: www.youtube.com/watch?v=GyuMozsVyYs \t\u00bb Survivors video references assault. Does not name or depict Reimers likeness.",
        "Trellis: Hostname blockpage.bt.com | hdredirect-lb7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com | itunes.apple.com | search.app.goo.gl  | www.youtube.com",
        "Trellis: https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "IDS Detections: Downloader (P2P Zeus dropper UA) Common Upatre Header Structure 2 Upatre Retrieving encoded payload (Common Header Struct)",
        "IDS Detections: Suspicious User-Agent containing Loader Observed TLS Handshake Failure",
        "Trellis: High Priority Alerts: network_icmp modifies_proxy_wpad packer_polymorphic",
        "Trellis:TrojanDownloader:Win32/Upatre.A  | Yara Detections Upack_all_versions",
        "Trellis: secure04-appleid.com | http://secure04-appleid.com | cpcalendars.secure04-appleid.com"
      ],
      "public": 1,
      "adversary": "Parking Crew",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Zbot.SIBG3!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBG3!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBG3!MTB"
        },
        {
          "id": "TrojanDownloader:Win32/Upatre.A",
          "display_name": "TrojanDownloader:Win32/Upatre.A",
          "target": "/malware/TrojanDownloader:Win32/Upatre.A"
        },
        {
          "id": "P2P ZeuS - S0016",
          "display_name": "P2P ZeuS - S0016",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1399",
          "name": "Modify Trusted Execution Environment",
          "display_name": "T1399 - Modify Trusted Execution Environment"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        }
      ],
      "industries": [
        "Research",
        "Telecommunications",
        "Technology",
        "Civilians"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 269,
        "FileHash-SHA1": 266,
        "FileHash-SHA256": 981,
        "domain": 480,
        "hostname": 684,
        "email": 1,
        "URL": 2102
      },
      "indicator_count": 4783,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "530 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mx0.venexus.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mx0.venexus.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776640936.2908263
}