{
  "type": "URL",
  "indicator": "https://mx01.prabhuinfotech.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mx01.prabhuinfotech.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3837963614,
      "indicator": "https://mx01.prabhuinfotech.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68b60e763115c3599ee16110",
          "name": "PAKISTANI CRIMINAL HACKING WITH SPAM  GAMEPROFITS.IO DILBOOSTENERGY.COM TSARA BRASHEARS",
          "description": "This fucking asshole has been spear fishing me since 2018 ,when he first started, he fucked up and used his real name. He was also the name on the github account that uploaded all my project files for gameprofits.io in 2018 , After careful reviewing of evidence the last many years I can say with 100000% confidence this is him. \n\nHe is also linked to my Pakistanti brother in law through marriage Muzammil Shah he owns thailotusnj.net these people robbed me, my friends and my family.\n\nDomain: adriancollege.us\nRegistrar: Spaceship, Inc. (IANA 3862)\nCreation Date: 2025-01-17\nExpiration Date: 2026-01-17\nStatus: clientTransferProhibited, serverTransferProhibited\n\nRegistrant:\n  Name: Muhammad Asim Raza\n  Street: chak 66 j.b dhandra, street no 64\n  City: Faisalabad, Punjab, PK\n  Postal Code: 38000\n  Phone: +92.3017273162\n\nhttps://www.linkedin.com/in/muhammad-asim-raza-97134a152/",
          "modified": "2025-10-01T21:00:52.280000",
          "created": "2025-09-01T21:21:58.165000",
          "tags": [
            "unknown",
            "as42044",
            "united kingdom"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "gameprofits.io",
            "id": "170823",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_170823/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 78,
            "FileHash-SHA256": 84,
            "hostname": 156,
            "URL": 424
          },
          "indicator_count": 742,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 49,
          "modified_text": "200 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c7b86fa120d19bbc88f367",
          "name": "Hijacker",
          "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
          "modified": "2024-03-11T17:01:59.026000",
          "created": "2024-02-10T17:54:55.243000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "tsara brashears",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "high level",
            "hackers",
            "hacktool",
            "download",
            "malware",
            "crypto",
            "hijacker",
            "monitoring",
            "installer",
            "tofsee",
            "domains domains",
            "domains files",
            "files files",
            "script",
            "kgs0",
            "kls0",
            "relic",
            "iframe",
            "pe32 executable",
            "ms windows",
            "intel",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "rticon neutral",
            "info compiler",
            "products id",
            "header intel",
            "name md5",
            "contained",
            "type",
            "language",
            "ico rtgroupicon",
            "neutral",
            "first",
            "utc submissions",
            "submitters",
            "company limited",
            "computer",
            "amazonaes",
            "china telecom",
            "group",
            "csc corporate",
            "domains",
            "malware spreading evader",
            "cnc",
            "malvertizing",
            "milehighmedia",
            "trojandropper",
            "moved",
            "passive dns",
            "urls",
            "as14576",
            "backdoor",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "trojan",
            "encrypt",
            "body",
            "date",
            "date hash",
            "avast avg",
            "mtb may",
            "kratona",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls https",
            "script urls",
            "united",
            "meta",
            "unknown",
            "emails",
            "name servers",
            "search",
            "as62597 nsone",
            "a domains",
            "as397241",
            "media",
            "next",
            "december",
            "unlocker",
            "threat round",
            "apple ios",
            "apple phone",
            "project",
            "blister",
            "agent tesla",
            "open",
            "execution",
            "videos",
            "strong",
            "porn videos",
            "watch",
            "daddy",
            "free",
            "top rated",
            "most viewed",
            "cancel anytime",
            "views",
            "play",
            "black",
            "enjoy",
            "czech",
            "hunk",
            "virtool",
            "cryp",
            "creation date",
            "otx telemetry",
            "expiration date",
            "servers",
            "status",
            "win32",
            "showing",
            "domain",
            "nxdomain",
            "as8075",
            "shell code",
            "threat",
            "cyber espionage",
            "cyber stalking",
            "danger",
            "critical",
            "attack",
            "treats",
            "as15169 google",
            "aaaa",
            "record value",
            "error",
            "entries",
            "hostname",
            "url http",
            "http",
            "files domain",
            "files related",
            "shinjiru msc",
            "sdn bhd",
            "dnssec",
            "protect",
            "as54455 madeit",
            "phishing",
            "backdoor",
            "contextualizing",
            "elevated exposure",
            "malvertizing",
            "ransom",
            "msil",
            "hackers for hire",
            "hashes",
            "http method",
            "get http",
            "http requests",
            "get dns",
            "ip traffic",
            "memory pattern",
            "pattern ips",
            "@emreimer",
            "iextract2",
            "cp cyber",
            "denver",
            "security",
            "siem compliance",
            "skip",
            "cybersecurity",
            "larimer st",
            "suite",
            "resources cyber",
            "risk assessment",
            "bill",
            "mind",
            "delaware",
            "pa",
            "arizona",
            "colorado",
            "stalkers",
            "deuteronomy 28:7",
            "hitmen"
          ],
          "references": [
            "honey.exe",
            "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
            "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
            "CS Sigma Rules: Python Initiated Connection by frack113",
            "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
            "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
            "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
            "api.login.live.com",
            "http://appleid.icloud.com-website33.org/",
            "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
            "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
            "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
            "message.htm.com",
            "http://pornhub.com/gay/video/search",
            "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
            "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "W32.Sality.PE",
              "display_name": "W32.Sality.PE",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Virus.Win32.Virut.q",
              "display_name": "Virus.Win32.Virut.q",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32",
              "display_name": "TrojanDropper:Win32",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 54,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6303,
            "FileHash-MD5": 215,
            "FileHash-SHA1": 192,
            "FileHash-SHA256": 2663,
            "domain": 2673,
            "hostname": 2686,
            "CVE": 2,
            "email": 16
          },
          "indicator_count": 14750,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "honey.exe",
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "http://pornhub.com/gay/video/search",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "api.login.live.com",
        "message.htm.com",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "http://appleid.icloud.com-website33.org/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Hacktool",
            "Trojandropper:win32",
            "Relic",
            "Tofsee",
            "W32.sality.pe",
            "Virtool",
            "Virus.win32.virut.q"
          ],
          "industries": [],
          "unique_indicators": 16171
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/prabhuinfotech.com",
    "whois": "http://whois.domaintools.com/prabhuinfotech.com",
    "domain": "prabhuinfotech.com",
    "hostname": "mx01.prabhuinfotech.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68b60e763115c3599ee16110",
      "name": "PAKISTANI CRIMINAL HACKING WITH SPAM  GAMEPROFITS.IO DILBOOSTENERGY.COM TSARA BRASHEARS",
      "description": "This fucking asshole has been spear fishing me since 2018 ,when he first started, he fucked up and used his real name. He was also the name on the github account that uploaded all my project files for gameprofits.io in 2018 , After careful reviewing of evidence the last many years I can say with 100000% confidence this is him. \n\nHe is also linked to my Pakistanti brother in law through marriage Muzammil Shah he owns thailotusnj.net these people robbed me, my friends and my family.\n\nDomain: adriancollege.us\nRegistrar: Spaceship, Inc. (IANA 3862)\nCreation Date: 2025-01-17\nExpiration Date: 2026-01-17\nStatus: clientTransferProhibited, serverTransferProhibited\n\nRegistrant:\n  Name: Muhammad Asim Raza\n  Street: chak 66 j.b dhandra, street no 64\n  City: Faisalabad, Punjab, PK\n  Postal Code: 38000\n  Phone: +92.3017273162\n\nhttps://www.linkedin.com/in/muhammad-asim-raza-97134a152/",
      "modified": "2025-10-01T21:00:52.280000",
      "created": "2025-09-01T21:21:58.165000",
      "tags": [
        "unknown",
        "as42044",
        "united kingdom"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "gameprofits.io",
        "id": "170823",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_170823/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 78,
        "FileHash-SHA256": 84,
        "hostname": 156,
        "URL": 424
      },
      "indicator_count": 742,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 49,
      "modified_text": "200 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c7b86fa120d19bbc88f367",
      "name": "Hijacker",
      "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
      "modified": "2024-03-11T17:01:59.026000",
      "created": "2024-02-10T17:54:55.243000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "tsara brashears",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "high level",
        "hackers",
        "hacktool",
        "download",
        "malware",
        "crypto",
        "hijacker",
        "monitoring",
        "installer",
        "tofsee",
        "domains domains",
        "domains files",
        "files files",
        "script",
        "kgs0",
        "kls0",
        "relic",
        "iframe",
        "pe32 executable",
        "ms windows",
        "intel",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "rticon neutral",
        "info compiler",
        "products id",
        "header intel",
        "name md5",
        "contained",
        "type",
        "language",
        "ico rtgroupicon",
        "neutral",
        "first",
        "utc submissions",
        "submitters",
        "company limited",
        "computer",
        "amazonaes",
        "china telecom",
        "group",
        "csc corporate",
        "domains",
        "malware spreading evader",
        "cnc",
        "malvertizing",
        "milehighmedia",
        "trojandropper",
        "moved",
        "passive dns",
        "urls",
        "as14576",
        "backdoor",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "trojan",
        "encrypt",
        "body",
        "date",
        "date hash",
        "avast avg",
        "mtb may",
        "kratona",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "urls https",
        "script urls",
        "united",
        "meta",
        "unknown",
        "emails",
        "name servers",
        "search",
        "as62597 nsone",
        "a domains",
        "as397241",
        "media",
        "next",
        "december",
        "unlocker",
        "threat round",
        "apple ios",
        "apple phone",
        "project",
        "blister",
        "agent tesla",
        "open",
        "execution",
        "videos",
        "strong",
        "porn videos",
        "watch",
        "daddy",
        "free",
        "top rated",
        "most viewed",
        "cancel anytime",
        "views",
        "play",
        "black",
        "enjoy",
        "czech",
        "hunk",
        "virtool",
        "cryp",
        "creation date",
        "otx telemetry",
        "expiration date",
        "servers",
        "status",
        "win32",
        "showing",
        "domain",
        "nxdomain",
        "as8075",
        "shell code",
        "threat",
        "cyber espionage",
        "cyber stalking",
        "danger",
        "critical",
        "attack",
        "treats",
        "as15169 google",
        "aaaa",
        "record value",
        "error",
        "entries",
        "hostname",
        "url http",
        "http",
        "files domain",
        "files related",
        "shinjiru msc",
        "sdn bhd",
        "dnssec",
        "protect",
        "as54455 madeit",
        "phishing",
        "backdoor",
        "contextualizing",
        "elevated exposure",
        "malvertizing",
        "ransom",
        "msil",
        "hackers for hire",
        "hashes",
        "http method",
        "get http",
        "http requests",
        "get dns",
        "ip traffic",
        "memory pattern",
        "pattern ips",
        "@emreimer",
        "iextract2",
        "cp cyber",
        "denver",
        "security",
        "siem compliance",
        "skip",
        "cybersecurity",
        "larimer st",
        "suite",
        "resources cyber",
        "risk assessment",
        "bill",
        "mind",
        "delaware",
        "pa",
        "arizona",
        "colorado",
        "stalkers",
        "deuteronomy 28:7",
        "hitmen"
      ],
      "references": [
        "honey.exe",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "api.login.live.com",
        "http://appleid.icloud.com-website33.org/",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "message.htm.com",
        "http://pornhub.com/gay/video/search",
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "W32.Sality.PE",
          "display_name": "W32.Sality.PE",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Virus.Win32.Virut.q",
          "display_name": "Virus.Win32.Virut.q",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32",
          "display_name": "TrojanDropper:Win32",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 54,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6303,
        "FileHash-MD5": 215,
        "FileHash-SHA1": 192,
        "FileHash-SHA256": 2663,
        "domain": 2673,
        "hostname": 2686,
        "CVE": 2,
        "email": 16
      },
      "indicator_count": 14750,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mx01.prabhuinfotech.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mx01.prabhuinfotech.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642421.1490524
}