{
  "type": "URL",
  "indicator": "https://nevvs.yah0o.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://nevvs.yah0o.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4073227190,
      "indicator": "https://nevvs.yah0o.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 13,
      "pulses": [
        {
          "id": "68ec0870475174302c733fa2",
          "name": "Cyber Crime - Emotet | Tofsee CnC | Targeting \u2022  Streaming \u2022 Stealing",
          "description": "I\u2019ve heard of mortis.com from a target. It was heavily suggested on targets YouTube homepage. I hadn\u2019t had thought to research link until Friday.\n\n Doing my due diligence I\u2019ve been viewing potential issues targets family member/s may be and his having with technology.\n\nSmart TV is completely hacked. playlist tampering , heavy downloading daily  when TV is on , off or unplugged. \n I watched this TV monitored data volume , noted    continued suggestions for Mortis.com , \ntouted  . Obviously, a threat. YouTuber warns not go in and no one can get in which is insanely stupid.  OTX issues,. Several pulse attempts later ,  constant refreshing and deleting of IoC this is all what remains. Streaming services, webcams and multiple labeled rooms. I have no idea the point of  death threats especially since God can mow anyone down. Who promised you another breath? Target seems to be  the only person targeted. Multiple Foundry , PayPal  Palantir\nLinks , Boeing, JetBlue Twitter , Apple loading issues.",
          "modified": "2025-11-11T04:02:27.091000",
          "created": "2025-10-12T19:58:40.472000",
          "tags": [
            "url https",
            "indicator role",
            "active related",
            "united",
            "ip address",
            "unknown ns",
            "x82xd4",
            "x86xd3",
            "xa1xf1",
            "xe8xc2x14",
            "win32tofsee",
            "trojan",
            "win32tofsee att",
            "ck ids",
            "t1096",
            "ntfs file",
            "service",
            "united kingdom",
            "germany",
            "netherlands",
            "mortis.com",
            "dead",
            "death",
            "foundry",
            "paypal",
            "home visitor",
            "psalms 37",
            "trojan",
            "emotet",
            "boeing",
            "apple",
            "streaming",
            "kryptik",
            "myundeadneighbor",
            "windstream communications llc",
            "command",
            "tofsee",
            "kx81xdbx0f",
            "wx99xcdx11",
            "stream",
            "write",
            "malware",
            "tsara brashears",
            "regsetvalueexa",
            "malware",
            "win32",
            "persistence",
            "execution",
            "push",
            "shellexecuteexw",
            "windows",
            "botnet",
            "backdoor",
            "writeconsolew",
            "displayname",
            "sddl",
            "hash",
            "ip address",
            "ssl certificate",
            "spawns",
            "initial access",
            "adversaries",
            "name tactics",
            "t1031",
            "registry",
            "dock",
            "suspicious",
            "learn",
            "phishing att",
            "infection",
            "commandand_and_control",
            "informative",
            "jetblue",
            "porn",
            "keylogger",
            "remote keylogger",
            "parklogic",
            "parking crew",
            "park pages",
            "cyber crime",
            "data brokers",
            "info stealers",
            "password",
            "masquerading",
            "discord",
            "sophisticated",
            "dga domains",
            "pit",
            "rotor",
            "hello",
            "targeting",
            "games"
          ],
          "references": [
            "mortis.com",
            "I unintentionally made the first pulse Public.",
            "Stalker/Lurker?http://myundeadneighbor.com | Parking Crews | Parklogic",
            "assassinationmarkets.com",
            "https://id.security.trackid",
            "https://id.security.trackid.piwikb7c1867dd7ba9c57.2ce7e2c4000f72e3204af57fac31aafd.mailingmarketing.net/",
            "https://id.login.update.ssl.encryption-6159368de39251d7a-login.id.security.trackid.piwikb7c1867dd7ba9c57.e988d676bdb63f3b4dbcdc53578a9b26.mailingmarketing.net/",
            "Hmm, cyber criminals use parking pages for malvertizing malicious content & intent  , reputation content, etc",
            "https://www.gov.pl/attachment/65dfce94-31f9-4523-8d3b-89df3d4c5f75"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Emotet.PC!MTB",
              "display_name": "Trojan:Win32/Emotet.PC!MTB",
              "target": "/malware/Trojan:Win32/Emotet.PC!MTB"
            },
            {
              "id": "Trojan:Win32/Emotet.KDS!MTB",
              "display_name": "Trojan:Win32/Emotet.KDS!MTB",
              "target": "/malware/Trojan:Win32/Emotet.KDS!MTB"
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Win.Malware.Tofsee-6880878-0",
              "display_name": "Win.Malware.Tofsee-6880878-0",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Win32:Kryptik-PLL",
              "display_name": "Win32:Kryptik-PLL",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1003.008",
              "name": "/etc/passwd and /etc/shadow",
              "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2407,
            "domain": 2321,
            "hostname": 983,
            "FileHash-SHA256": 3035,
            "FileHash-MD5": 228,
            "FileHash-SHA1": 231,
            "email": 1,
            "FilePath": 3
          },
          "indicator_count": 9209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "160 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ddf5bda001ff2f840c20e7",
          "name": "Mofksys - Originated from an X.com image",
          "description": "Mofksys - Originated from an X.com image  Clicked on image to expand. Image coded. IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWFF.COM - Seen before. Associated with Pegasus in the past. \n\n#wannacry #wannacrypt #ransomware #phishing #other_malware_packed#cabby#driveby #milesmx #keystrokes #record #screencapture #mofksys #remote access #fullaccess #code -#botnet #deadhost #otx_pulsed #hilo:",
          "modified": "2025-11-01T03:03:51.684000",
          "created": "2025-10-02T03:47:09.092000",
          "tags": [
            "url http",
            "url https",
            "h oct",
            "united",
            "netherlands",
            "present apr",
            "passive dns",
            "ip address",
            "present jul",
            "domain add",
            "pulse pulses",
            "urls",
            "files",
            "trojan",
            "entries",
            "next associated",
            "mtb nov",
            "ipv4 add",
            "overview domain",
            "files ip",
            "address",
            "location united",
            "asn asnone",
            "whois registrar",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3888,
            "domain": 1009,
            "hostname": 2134,
            "FileHash-SHA256": 2150,
            "CVE": 1,
            "FileHash-MD5": 106,
            "FileHash-SHA1": 107
          },
          "indicator_count": 9395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "170 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68d332d77a7eedf3ad71c406",
          "name": "Denizbankk.net \u2022  LevelBlue - Open Threat Exchange",
          "description": "Denizbankk.net \u2022 Debian.org \u2022 hallrender.com \u2022 alienvault.com \u2022 hopto.org \u2022 striven.com| ? | This is concerning. It\u2019s not like intended to find what I have found but I am disappointed. The few people on the platform who do their own research eventually leave with a large amount of reposters. Related to haallrendee, brian sabey and each link listed. Stange happenings this weak. [otx auto populated- Google Safe Browsing, Denizbankk.net, has been used by the Russian government to create a secure web address that can be accessed only if the user has the correct address.{",
          "modified": "2025-10-23T23:03:23.167000",
          "created": "2025-09-23T23:52:55.453000",
          "tags": [
            "log id",
            "gmtn",
            "tls web",
            "zerossl",
            "zerossl rsa",
            "domain secure",
            "site ca",
            "fa c7",
            "ocsp",
            "a167",
            "code",
            "keepalive",
            "false",
            "record type",
            "ttl a",
            "value",
            "o jarm",
            "fingerprint",
            "file format",
            "relevance",
            "united",
            "tempe",
            "arizona create",
            "domain",
            "expiry date",
            "name",
            "query time",
            "technical city",
            "tempe technical",
            "technical state",
            "rdap database",
            "handle",
            "iana registrar",
            "links",
            "algorithm",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl rsa",
            "validity",
            "server",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "registrar iana",
            "registrar url",
            "registrar whois",
            "date",
            "available from",
            "country",
            "proxy",
            "postal code",
            "city",
            "admin city",
            "tempe admin",
            "filehashmd5",
            "url https",
            "filehashsha1",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashsha256",
            "showing",
            "germany unknown",
            "passive dns",
            "entries",
            "a domains",
            "body doctype",
            "content type",
            "gmt server",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "main",
            "apache",
            "accept",
            "title",
            "present dec",
            "present jun",
            "present nov",
            "aaaa",
            "present feb",
            "present sep",
            "search",
            "canada",
            "encrypt",
            "devam",
            "ad soyad",
            "mteri numaras",
            "gvenlik iin",
            "gizli soru",
            "gvenlik sorusu",
            "cevab",
            "ltfen bir",
            "present may",
            "moved",
            "present oct",
            "ip address",
            "gandi sas",
            "body",
            "backdoor",
            "next associated",
            "trojandropper",
            "fastly error",
            "please",
            "sea p",
            "twitter",
            "win32",
            "creation date",
            "name servers",
            "hostname add",
            "pulse pulses",
            "urls",
            "record value",
            "japan",
            "germany",
            "ipv4",
            "countries",
            "america",
            "netherlands",
            "italy",
            "brian sabey",
            "report spam",
            "tsara brashears",
            "created",
            "days ago",
            "green well",
            "sabey stash",
            "service",
            "hours ago",
            "malicious",
            "forbidden",
            "actionlistccc",
            "malware family",
            "mufanom att",
            "capture",
            "ck ids",
            "checkin",
            "t1036",
            "t1055",
            "injection",
            "t1056"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 617,
            "URL": 2495,
            "hostname": 1698,
            "FileHash-MD5": 275,
            "FileHash-SHA1": 265,
            "FileHash-SHA256": 1241,
            "SSLCertFingerprint": 2,
            "email": 4
          },
          "indicator_count": 6597,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "178 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68d3368ae75cccf736a55441",
          "name": "ET TROJAN Hiloti/Mufanom Downloader Checkin | Denizbankk.net",
          "description": "",
          "modified": "2025-10-23T23:03:23.167000",
          "created": "2025-09-24T00:08:42.048000",
          "tags": [
            "log id",
            "gmtn",
            "tls web",
            "zerossl",
            "zerossl rsa",
            "domain secure",
            "site ca",
            "fa c7",
            "ocsp",
            "a167",
            "code",
            "keepalive",
            "false",
            "record type",
            "ttl a",
            "value",
            "o jarm",
            "fingerprint",
            "file format",
            "relevance",
            "united",
            "tempe",
            "arizona create",
            "domain",
            "expiry date",
            "name",
            "query time",
            "technical city",
            "tempe technical",
            "technical state",
            "rdap database",
            "handle",
            "iana registrar",
            "links",
            "algorithm",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl rsa",
            "validity",
            "server",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "registrar iana",
            "registrar url",
            "registrar whois",
            "date",
            "available from",
            "country",
            "proxy",
            "postal code",
            "city",
            "admin city",
            "tempe admin",
            "filehashmd5",
            "url https",
            "filehashsha1",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashsha256",
            "showing",
            "germany unknown",
            "passive dns",
            "entries",
            "a domains",
            "body doctype",
            "content type",
            "gmt server",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "main",
            "apache",
            "accept",
            "title",
            "present dec",
            "present jun",
            "present nov",
            "aaaa",
            "present feb",
            "present sep",
            "search",
            "canada",
            "encrypt",
            "devam",
            "ad soyad",
            "mteri numaras",
            "gvenlik iin",
            "gizli soru",
            "gvenlik sorusu",
            "cevab",
            "ltfen bir",
            "present may",
            "moved",
            "present oct",
            "ip address",
            "gandi sas",
            "body",
            "backdoor",
            "next associated",
            "trojandropper",
            "fastly error",
            "please",
            "sea p",
            "twitter",
            "win32",
            "creation date",
            "name servers",
            "hostname add",
            "pulse pulses",
            "urls",
            "record value",
            "japan",
            "germany",
            "ipv4",
            "countries",
            "america",
            "netherlands",
            "italy",
            "brian sabey",
            "report spam",
            "tsara brashears",
            "created",
            "days ago",
            "green well",
            "sabey stash",
            "service",
            "hours ago",
            "malicious",
            "forbidden",
            "actionlistccc",
            "malware family",
            "mufanom att",
            "capture",
            "ck ids",
            "checkin",
            "t1036",
            "t1055",
            "injection",
            "t1056"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68d332d77a7eedf3ad71c406",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 617,
            "URL": 2495,
            "hostname": 1698,
            "FileHash-MD5": 275,
            "FileHash-SHA1": 265,
            "FileHash-SHA256": 1241,
            "SSLCertFingerprint": 2,
            "email": 4
          },
          "indicator_count": 6597,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "178 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "686d28ec9208b0424e0ccad2",
          "name": "Remote Keylogger | Foundry",
          "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
          "modified": "2025-09-19T03:02:22.742000",
          "created": "2025-07-08T14:19:24.211000",
          "tags": [
            "delete",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "delete c",
            "intel",
            "write",
            "malware",
            "dynamicloader",
            "yara rule",
            "high",
            "vmware",
            "phishing",
            "remote",
            "keylogger",
            "remote keylogger",
            "type indicator",
            "related pulses",
            "no expiration",
            "url https",
            "showing",
            "reputation",
            "foundry",
            "apple",
            "downloader",
            "trojan"
          ],
          "references": [
            "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
            "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
            "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
            "\u2022  199.59.243.226",
            "\u2022 ww25.vpn.steamcommunity-site.info",
            "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
            "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
            "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
            "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
            "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "Reputation.1",
              "display_name": "Reputation.1",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 260,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 4406,
            "URL": 9684,
            "domain": 3164,
            "hostname": 3370,
            "CVE": 1
          },
          "indicator_count": 21129,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "213 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468500f573317422968c7c",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:52.404000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468501eb091ae414509121",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:53.417000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468505ee31db44fe063e82",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:57.123000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6846850783baea1a6beb7e71",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. I won\u2019t be surprised if OTX cannot pull the threat. My account isn\u2019t allowing me full permissions. \n\n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:59.933000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468511340fb7ba8eeb7aae",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:54:09.116000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6846860a0c5ff214f345717c",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:58:17.902000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6846860ee9b4faefae8d4cf9",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:58:22.091000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6841039ff61dea1fcdcc53c1",
          "name": "Malicious WiFi Internet network | trojan.morstar/bundler",
          "description": "WiFi / Internet provider \nConcerning- targeting?\nhttp://www.dead-speak.com/PsychicMediums.htm | \nhttp://www.dead-speak.com/PsychicMediums.html |\nwww.dead-speak.com || https://pin.it/ | \nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian |\npin.it |",
          "modified": "2025-07-05T02:01:54.546000",
          "created": "2025-06-05T02:40:31.779000",
          "tags": [
            "win32 exe",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "get http",
            "post http",
            "dns resolutions",
            "resolved ips",
            "symantec time",
            "stamping",
            "from",
            "algorithm",
            "thumbprint",
            "thumbprint md5",
            "signer",
            "g2 issuer",
            "ca valid",
            "serial number",
            "time stamping",
            "g4 issuer",
            "g2 valid",
            "usage ff",
            "code signing",
            "issuer certum",
            "certum code",
            "signing ca",
            "trusted network",
            "e5 e5",
            "d4 portable",
            "sha256",
            "overlay",
            "defense evasion",
            "access ta0006",
            "command",
            "control ta0011",
            "catalog tree",
            "anti",
            "ob0001",
            "analysis ob0002",
            "control ob0004",
            "ob0007 impact",
            "ob0012 file",
            "system oc0001",
            "memory oc0002",
            "data oc0004"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "FileHash-MD5": 156,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 3313,
            "URL": 1223,
            "domain": 186,
            "hostname": 313
          },
          "indicator_count": 5332,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "289 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://id.login.update.ssl.encryption-6159368de39251d7a-login.id.security.trackid.piwikb7c1867dd7ba9c57.e988d676bdb63f3b4dbcdc53578a9b26.mailingmarketing.net/",
        "I unintentionally made the first pulse Public.",
        "assassinationmarkets.com",
        "\u2022  199.59.243.226",
        "Hmm, cyber criminals use parking pages for malvertizing malicious content & intent  , reputation content, etc",
        "Stalker/Lurker?http://myundeadneighbor.com | Parking Crews | Parklogic",
        "https://id.security.trackid.piwikb7c1867dd7ba9c57.2ce7e2c4000f72e3204af57fac31aafd.mailingmarketing.net/",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "https://www.gov.pl/attachment/65dfce94-31f9-4523-8d3b-89df3d4c5f75",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "https://id.security.trackid",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "mortis.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win32:kryptik-pll",
            "Tofsee",
            "Backdoor:win32/tofsee.t",
            "Trojan:win32/emotet.pc!mtb",
            "Reputation.1",
            "Unruy",
            "Win.malware.tofsee-6880878-0",
            "Trojan:win32/emotet.kds!mtb"
          ],
          "industries": [
            "Telecommunications",
            "Media",
            "Technology"
          ],
          "unique_indicators": 55797
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/yah0o.com",
    "whois": "http://whois.domaintools.com/yah0o.com",
    "domain": "yah0o.com",
    "hostname": "nevvs.yah0o.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 13,
  "pulses": [
    {
      "id": "68ec0870475174302c733fa2",
      "name": "Cyber Crime - Emotet | Tofsee CnC | Targeting \u2022  Streaming \u2022 Stealing",
      "description": "I\u2019ve heard of mortis.com from a target. It was heavily suggested on targets YouTube homepage. I hadn\u2019t had thought to research link until Friday.\n\n Doing my due diligence I\u2019ve been viewing potential issues targets family member/s may be and his having with technology.\n\nSmart TV is completely hacked. playlist tampering , heavy downloading daily  when TV is on , off or unplugged. \n I watched this TV monitored data volume , noted    continued suggestions for Mortis.com , \ntouted  . Obviously, a threat. YouTuber warns not go in and no one can get in which is insanely stupid.  OTX issues,. Several pulse attempts later ,  constant refreshing and deleting of IoC this is all what remains. Streaming services, webcams and multiple labeled rooms. I have no idea the point of  death threats especially since God can mow anyone down. Who promised you another breath? Target seems to be  the only person targeted. Multiple Foundry , PayPal  Palantir\nLinks , Boeing, JetBlue Twitter , Apple loading issues.",
      "modified": "2025-11-11T04:02:27.091000",
      "created": "2025-10-12T19:58:40.472000",
      "tags": [
        "url https",
        "indicator role",
        "active related",
        "united",
        "ip address",
        "unknown ns",
        "x82xd4",
        "x86xd3",
        "xa1xf1",
        "xe8xc2x14",
        "win32tofsee",
        "trojan",
        "win32tofsee att",
        "ck ids",
        "t1096",
        "ntfs file",
        "service",
        "united kingdom",
        "germany",
        "netherlands",
        "mortis.com",
        "dead",
        "death",
        "foundry",
        "paypal",
        "home visitor",
        "psalms 37",
        "trojan",
        "emotet",
        "boeing",
        "apple",
        "streaming",
        "kryptik",
        "myundeadneighbor",
        "windstream communications llc",
        "command",
        "tofsee",
        "kx81xdbx0f",
        "wx99xcdx11",
        "stream",
        "write",
        "malware",
        "tsara brashears",
        "regsetvalueexa",
        "malware",
        "win32",
        "persistence",
        "execution",
        "push",
        "shellexecuteexw",
        "windows",
        "botnet",
        "backdoor",
        "writeconsolew",
        "displayname",
        "sddl",
        "hash",
        "ip address",
        "ssl certificate",
        "spawns",
        "initial access",
        "adversaries",
        "name tactics",
        "t1031",
        "registry",
        "dock",
        "suspicious",
        "learn",
        "phishing att",
        "infection",
        "commandand_and_control",
        "informative",
        "jetblue",
        "porn",
        "keylogger",
        "remote keylogger",
        "parklogic",
        "parking crew",
        "park pages",
        "cyber crime",
        "data brokers",
        "info stealers",
        "password",
        "masquerading",
        "discord",
        "sophisticated",
        "dga domains",
        "pit",
        "rotor",
        "hello",
        "targeting",
        "games"
      ],
      "references": [
        "mortis.com",
        "I unintentionally made the first pulse Public.",
        "Stalker/Lurker?http://myundeadneighbor.com | Parking Crews | Parklogic",
        "assassinationmarkets.com",
        "https://id.security.trackid",
        "https://id.security.trackid.piwikb7c1867dd7ba9c57.2ce7e2c4000f72e3204af57fac31aafd.mailingmarketing.net/",
        "https://id.login.update.ssl.encryption-6159368de39251d7a-login.id.security.trackid.piwikb7c1867dd7ba9c57.e988d676bdb63f3b4dbcdc53578a9b26.mailingmarketing.net/",
        "Hmm, cyber criminals use parking pages for malvertizing malicious content & intent  , reputation content, etc",
        "https://www.gov.pl/attachment/65dfce94-31f9-4523-8d3b-89df3d4c5f75"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Emotet.PC!MTB",
          "display_name": "Trojan:Win32/Emotet.PC!MTB",
          "target": "/malware/Trojan:Win32/Emotet.PC!MTB"
        },
        {
          "id": "Trojan:Win32/Emotet.KDS!MTB",
          "display_name": "Trojan:Win32/Emotet.KDS!MTB",
          "target": "/malware/Trojan:Win32/Emotet.KDS!MTB"
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Win.Malware.Tofsee-6880878-0",
          "display_name": "Win.Malware.Tofsee-6880878-0",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Win32:Kryptik-PLL",
          "display_name": "Win32:Kryptik-PLL",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1003.008",
          "name": "/etc/passwd and /etc/shadow",
          "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2407,
        "domain": 2321,
        "hostname": 983,
        "FileHash-SHA256": 3035,
        "FileHash-MD5": 228,
        "FileHash-SHA1": 231,
        "email": 1,
        "FilePath": 3
      },
      "indicator_count": 9209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "160 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ddf5bda001ff2f840c20e7",
      "name": "Mofksys - Originated from an X.com image",
      "description": "Mofksys - Originated from an X.com image  Clicked on image to expand. Image coded. IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWFF.COM - Seen before. Associated with Pegasus in the past. \n\n#wannacry #wannacrypt #ransomware #phishing #other_malware_packed#cabby#driveby #milesmx #keystrokes #record #screencapture #mofksys #remote access #fullaccess #code -#botnet #deadhost #otx_pulsed #hilo:",
      "modified": "2025-11-01T03:03:51.684000",
      "created": "2025-10-02T03:47:09.092000",
      "tags": [
        "url http",
        "url https",
        "h oct",
        "united",
        "netherlands",
        "present apr",
        "passive dns",
        "ip address",
        "present jul",
        "domain add",
        "pulse pulses",
        "urls",
        "files",
        "trojan",
        "entries",
        "next associated",
        "mtb nov",
        "ipv4 add",
        "overview domain",
        "files ip",
        "address",
        "location united",
        "asn asnone",
        "whois registrar",
        "mtb apr",
        "files show",
        "date hash",
        "avast avg"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3888,
        "domain": 1009,
        "hostname": 2134,
        "FileHash-SHA256": 2150,
        "CVE": 1,
        "FileHash-MD5": 106,
        "FileHash-SHA1": 107
      },
      "indicator_count": 9395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "170 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68d332d77a7eedf3ad71c406",
      "name": "Denizbankk.net \u2022  LevelBlue - Open Threat Exchange",
      "description": "Denizbankk.net \u2022 Debian.org \u2022 hallrender.com \u2022 alienvault.com \u2022 hopto.org \u2022 striven.com| ? | This is concerning. It\u2019s not like intended to find what I have found but I am disappointed. The few people on the platform who do their own research eventually leave with a large amount of reposters. Related to haallrendee, brian sabey and each link listed. Stange happenings this weak. [otx auto populated- Google Safe Browsing, Denizbankk.net, has been used by the Russian government to create a secure web address that can be accessed only if the user has the correct address.{",
      "modified": "2025-10-23T23:03:23.167000",
      "created": "2025-09-23T23:52:55.453000",
      "tags": [
        "log id",
        "gmtn",
        "tls web",
        "zerossl",
        "zerossl rsa",
        "domain secure",
        "site ca",
        "fa c7",
        "ocsp",
        "a167",
        "code",
        "keepalive",
        "false",
        "record type",
        "ttl a",
        "value",
        "o jarm",
        "fingerprint",
        "file format",
        "relevance",
        "united",
        "tempe",
        "arizona create",
        "domain",
        "expiry date",
        "name",
        "query time",
        "technical city",
        "tempe technical",
        "technical state",
        "rdap database",
        "handle",
        "iana registrar",
        "links",
        "algorithm",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl rsa",
        "validity",
        "server",
        "domain name",
        "status",
        "abuse contact",
        "email",
        "registrar abuse",
        "contact phone",
        "registrar iana",
        "registrar url",
        "registrar whois",
        "date",
        "available from",
        "country",
        "proxy",
        "postal code",
        "city",
        "admin city",
        "tempe admin",
        "filehashmd5",
        "url https",
        "filehashsha1",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashsha256",
        "showing",
        "germany unknown",
        "passive dns",
        "entries",
        "a domains",
        "body doctype",
        "content type",
        "gmt server",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "main",
        "apache",
        "accept",
        "title",
        "present dec",
        "present jun",
        "present nov",
        "aaaa",
        "present feb",
        "present sep",
        "search",
        "canada",
        "encrypt",
        "devam",
        "ad soyad",
        "mteri numaras",
        "gvenlik iin",
        "gizli soru",
        "gvenlik sorusu",
        "cevab",
        "ltfen bir",
        "present may",
        "moved",
        "present oct",
        "ip address",
        "gandi sas",
        "body",
        "backdoor",
        "next associated",
        "trojandropper",
        "fastly error",
        "please",
        "sea p",
        "twitter",
        "win32",
        "creation date",
        "name servers",
        "hostname add",
        "pulse pulses",
        "urls",
        "record value",
        "japan",
        "germany",
        "ipv4",
        "countries",
        "america",
        "netherlands",
        "italy",
        "brian sabey",
        "report spam",
        "tsara brashears",
        "created",
        "days ago",
        "green well",
        "sabey stash",
        "service",
        "hours ago",
        "malicious",
        "forbidden",
        "actionlistccc",
        "malware family",
        "mufanom att",
        "capture",
        "ck ids",
        "checkin",
        "t1036",
        "t1055",
        "injection",
        "t1056"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 617,
        "URL": 2495,
        "hostname": 1698,
        "FileHash-MD5": 275,
        "FileHash-SHA1": 265,
        "FileHash-SHA256": 1241,
        "SSLCertFingerprint": 2,
        "email": 4
      },
      "indicator_count": 6597,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "178 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68d3368ae75cccf736a55441",
      "name": "ET TROJAN Hiloti/Mufanom Downloader Checkin | Denizbankk.net",
      "description": "",
      "modified": "2025-10-23T23:03:23.167000",
      "created": "2025-09-24T00:08:42.048000",
      "tags": [
        "log id",
        "gmtn",
        "tls web",
        "zerossl",
        "zerossl rsa",
        "domain secure",
        "site ca",
        "fa c7",
        "ocsp",
        "a167",
        "code",
        "keepalive",
        "false",
        "record type",
        "ttl a",
        "value",
        "o jarm",
        "fingerprint",
        "file format",
        "relevance",
        "united",
        "tempe",
        "arizona create",
        "domain",
        "expiry date",
        "name",
        "query time",
        "technical city",
        "tempe technical",
        "technical state",
        "rdap database",
        "handle",
        "iana registrar",
        "links",
        "algorithm",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl rsa",
        "validity",
        "server",
        "domain name",
        "status",
        "abuse contact",
        "email",
        "registrar abuse",
        "contact phone",
        "registrar iana",
        "registrar url",
        "registrar whois",
        "date",
        "available from",
        "country",
        "proxy",
        "postal code",
        "city",
        "admin city",
        "tempe admin",
        "filehashmd5",
        "url https",
        "filehashsha1",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashsha256",
        "showing",
        "germany unknown",
        "passive dns",
        "entries",
        "a domains",
        "body doctype",
        "content type",
        "gmt server",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "main",
        "apache",
        "accept",
        "title",
        "present dec",
        "present jun",
        "present nov",
        "aaaa",
        "present feb",
        "present sep",
        "search",
        "canada",
        "encrypt",
        "devam",
        "ad soyad",
        "mteri numaras",
        "gvenlik iin",
        "gizli soru",
        "gvenlik sorusu",
        "cevab",
        "ltfen bir",
        "present may",
        "moved",
        "present oct",
        "ip address",
        "gandi sas",
        "body",
        "backdoor",
        "next associated",
        "trojandropper",
        "fastly error",
        "please",
        "sea p",
        "twitter",
        "win32",
        "creation date",
        "name servers",
        "hostname add",
        "pulse pulses",
        "urls",
        "record value",
        "japan",
        "germany",
        "ipv4",
        "countries",
        "america",
        "netherlands",
        "italy",
        "brian sabey",
        "report spam",
        "tsara brashears",
        "created",
        "days ago",
        "green well",
        "sabey stash",
        "service",
        "hours ago",
        "malicious",
        "forbidden",
        "actionlistccc",
        "malware family",
        "mufanom att",
        "capture",
        "ck ids",
        "checkin",
        "t1036",
        "t1055",
        "injection",
        "t1056"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68d332d77a7eedf3ad71c406",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 617,
        "URL": 2495,
        "hostname": 1698,
        "FileHash-MD5": 275,
        "FileHash-SHA1": 265,
        "FileHash-SHA256": 1241,
        "SSLCertFingerprint": 2,
        "email": 4
      },
      "indicator_count": 6597,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "178 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "686d28ec9208b0424e0ccad2",
      "name": "Remote Keylogger | Foundry",
      "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
      "modified": "2025-09-19T03:02:22.742000",
      "created": "2025-07-08T14:19:24.211000",
      "tags": [
        "delete",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "delete c",
        "intel",
        "write",
        "malware",
        "dynamicloader",
        "yara rule",
        "high",
        "vmware",
        "phishing",
        "remote",
        "keylogger",
        "remote keylogger",
        "type indicator",
        "related pulses",
        "no expiration",
        "url https",
        "showing",
        "reputation",
        "foundry",
        "apple",
        "downloader",
        "trojan"
      ],
      "references": [
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "\u2022  199.59.243.226",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "Reputation.1",
          "display_name": "Reputation.1",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology",
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 260,
        "FileHash-SHA1": 244,
        "FileHash-SHA256": 4406,
        "URL": 9684,
        "domain": 3164,
        "hostname": 3370,
        "CVE": 1
      },
      "indicator_count": 21129,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "213 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468500f573317422968c7c",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:52.404000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468501eb091ae414509121",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:53.417000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468505ee31db44fe063e82",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:57.123000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6846850783baea1a6beb7e71",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. I won\u2019t be surprised if OTX cannot pull the threat. My account isn\u2019t allowing me full permissions. \n\n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:59.933000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468511340fb7ba8eeb7aae",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:54:09.116000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://nevvs.yah0o.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://nevvs.yah0o.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776660454.3365314
}