{ "type": "URL", "indicator": "https://ns-1158.awsdns-16.org/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://ns-1158.awsdns-16.org/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4137909402, "indicator": "https://ns-1158.awsdns-16.org/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "699b907c5375efb7ce1639b8", "name": "Apple Redirects in Apple Support = IcedID | MITM attack", "description": "Researching targets former iPhone. Redirect in Apple support. [support.apple.com/ht^*^ redirects to support.apple.com/de/^*^*^] IcedID identified. | Environment: 3 -5 suspected compromised devices present. Behavior: iPhone reset itself twice, deleted passcodes, required new passcodes, compromised contacts notified target added a new device (FALSE) , threat actor stole Apple cash , added , Password storage, reset television. Targeted another device auto downloaded a Mimecast compromise, attached to iCloud , corrupted files downloaded. Emotet identified. Reset SmartTV. Browser bar AI: mood swings. Overt changes, white screen, pink screens, thread erased. Identified OTX. as a honeypot also states it\u2019s legitimate. I dumped information. AI agents focused on victim leaving shreds of evidence , paper trail , w/ anyone ,anywhere. AI model told truth \u2018I don\u2019t like you , you\u2019ve changed, you lied, you changed all facts .\u201d,etc. An acceptable baseline of communication established . #botnet #command_and_control #IcedID", "modified": "2026-03-24T21:11:04.306000", "created": "2026-02-22T23:25:48.722000", "tags": [ "dynamicloader", "tls handshake", "failure", "whitelisted", "akamai", "yara detections", "trojan", "write", "zeppelin", "malware", "hostile", "unknown", "port", "destination", "read c", "united", "as16625 akamai", "win32", "persistence", "execution", "passive dns", "urls", "otx logo", "all url", "http", "ip address", "related nids", "files location", "win32mydoom feb", "name servers", "servers", "worm", "virtool", "files", "ipv4", "reverse dns", "america flag", "america asn", "United States", "unknown ns", "asn as714", "invalid url", "mtb oct", "mtb sep", "lowfi", "trojanspy", "total", "push", "defender", "china unknown", "mtb apr", "ok server", "gmt content", "type", "accept", "show", "todo", "all filehash", "av detections", "shift", "url http", "url https", "hostname", "type indicator", "source hostname", "writeconsolew", "post https", "tlsv1", "medium", "write c", "dock", "command", "control", "icedid", "domain", "all domain", "status", "hostname add", "crlf line", "unicode text", "utf8", "ee fc", "yara rule", "ff d5", "ascii text", "f0 ff", "eb e1", "music", "next", "autorun", "suspicious", "compatibility", "mode", "entries", "lredmond", "stwashington", "search", "tls sni", "denmark", "body html", "head title", "title head", "body h1", "all ipv4", "url analysis", "users", "ff ff", "files domain", "files related", "url add", "flag united", "present apr", "location united", "asn asnone", "as16509", "moved", "title", "body", "code", "mydoom", "bot net", "mitm", "aquire", "hidden users", "no expiration", "filehashsha256", "expiration", "showing", "indicator role", "pulses url", "pulse show", "iot", "Iced iced baby" ], "references": [ "support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^", "This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching", "IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure", "df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word", "div>

", "Same legal , and quasi governmental pattern identified", "I apologize for the lack of reference.", "Requires further research.", "Will pulse remaining Apple IoC\u2019s in next pulse", "https://l.us-1.a.mimecastprotect.com/l", "It appears there are 5-7 known affected that I was able to find" ], "public": 1, "adversary": "", "targeted_countries": [ "Germany", "Denmark", "United States of America", "Japan" ], "malware_families": [ { "id": "Icedid", "display_name": "Icedid", "target": null }, { "id": "Trojan:Win32/SmkLdr.H!MTB", "display_name": "Trojan:Win32/SmkLdr.H!MTB", "target": "/malware/Trojan:Win32/SmkLdr.H!MTB" }, { "id": "#Lowfi:Lua:DllSuspiciousExport.A", "display_name": "#Lowfi:Lua:DllSuspiciousExport.A", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1608.001", "name": "Upload Malware", "display_name": "T1608.001 - Upload Malware" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1557", "name": "Man-in-the-Middle", "display_name": "T1557 - Man-in-the-Middle" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Telecom", "Legal" ], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2051, "FileHash-SHA256": 1706, "URL": 6984, "domain": 1097, "FileHash-MD5": 401, "FileHash-SHA1": 276, "SSLCertFingerprint": 9, "email": 13, "CVE": 1 }, "indicator_count": 12538, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "69 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6958372ef9da31513d96bebb", "name": "Connected-IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation", "description": "Retaliation? IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation for malicious control | found in the analytics of a highly target device: I\u2019ve included related pulses from 2 other threat responders and an Apple discussion post. Surprisingly, most of the IoC\u2019s pulsed came from one page of analytics. | \u2022 \"avconferenced\", \"procPath\" : \"\\/usr\\/libexec\\/avconferenced | 180.4.1.2 | a version of\npegasus found. | https://prometheus-pushgateway-internal.preview.tp-staging.com/\t\nhostname: prometheus.netmaker.vonnue.dev\t\nhostname: prometheus.dev.aws.finoa.io |\nSince Prometheus pulse . I realize now every Prometheus pulse illicits outrageous behavior.. Is this a secret society? Try to be more secretive. Owl heads in lawn. This behavior illicits investigation for a fix. Please STOP. I\u2019m done looking at Prometheus. Please stop leaving artifacts.", "modified": "2026-02-01T20:00:08.812000", "created": "2026-01-02T21:22:54.247000", "tags": [ "syscall", "nsrunloop", "objcclass", "region type", "start", "vsize", "prtmax shrmod", "region detailn", "unused space", "at startn", "guard", "urls", "url analysis", "verdict", "domain", "address", "location japan", "hikone", "japan asn", "as4713 ntt", "related tags", "none external", "aaaa", "united", "passive dns", "ip address", "japan", "present dec", "domain add", "files", "japan unknown", "present jul", "present oct", "present sep", "present aug", "present jun", "japan showing", "urls show", "date checked", "url hostname", "server response", "google safe", "reverse dns", "present nov", "present", "present may", "present mar", "present apr", "data upload", "extraction", "failed", "files ip", "moved", "gmt content", "ipv4 add", "location united", "title", "ipv4", "dns resolutions", "hostname add", "asn as4713", "all ipv4", "google", "ocn ntt", "googlecl", "http", "amazon02", "akamaias", "page url", "yahoojp", "december", "jp summary", "february", "asn15169", "tokyo", "kansas city", "asn396982", "asn30286", "asn16509", "cisco", "umbrella rank", "cisco umbrella", "rank", "kitashinagawa", "sureserver ev", "ca g3", "domains", "hashes", "microsoft", "docomo business", "ml14325", "as autonomous", "asn8075", "ip information", "ipasns ip", "detail domain", "domain tree", "links domain", "requested", "value", "automatic", "webgl", "please", "mr value", "muid value", "mjl function", "dcmlinker", "paq string", "kb script", "b image", "b script", "frame a344", "redirect chain", "kb document", "frame", "b xhr", "kb image", "fetch collect", "request chain", "redirected", "http redirect", "name servers", "redacted for", "servers", "unknown aaaa", "search", "for privacy", "domeny serwery", "verdana tahoma", "arial", "gmt contenttype", "meta", "small", "results jan", "present jan", "status", "record value", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "process details", "flag", "japan japan", "pattern match", "ascii text", "mitre att", "ck id", "null", "refresh", "span", "hybrid", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "learn", "name tactics", "suspicious", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "monitored target", "pulse submit", "wikipedia", "imap", "smtp", "ocn open", "discussion", "stub", "jprs database", "ocnnttocn", "maintenance", "outages notice", "lock status", "state", "connected", "organization", "type", "name", "server", "name server", "connected date", "algorithm", "key identifier", "data", "v3 serial", "number", "cjp ocybertrust", "ev ca", "g3 validity", "ku ontt", "docomo", "record type", "ttl value", "thumbprint", "emails", "date", "trojan", "pegasus", "title error", "hostname", "pulse pulses", "entries", "mtb apr", "lowfi", "win32", "a domains", "body", "worm", "virtool", "cybota", "showing", "palantir", "prometheus" ], "references": [ "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp", "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp", "ocn.ad.jp - Registrant Org: NTT Communications Corporation", "Page Title: \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN", "Nippon Telegraph and Telephone Corporation one governmental now privated", "computersandsoftware \u2022 portal sites \u2022 search engines and portals", "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com", "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2", "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80", "https://discussions.apple.com/thread/255214328?sortBy=rank", "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators", "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact", "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com", "swarm-foundry.com", "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org Domain kinkfuck.com \u2022 nobodycares.art", "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com", "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5", "server-3-164-143-102.nrt20.r.cloudfront.net", "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com", "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com", "https://ww41.porn25.com/", "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA", "If something curious is found on privatelybowen property we have a constitutional right to examine it.", "Other constitutional rights and privileges written in law where severe courses of action is allowed", "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..", "Device targeted with l RMS Modules by male in Denver, Co", "Attempts to clip target at high rate of speed.Seen again at her residence in October", "Target was monitored in store and followed home needed to stop multiple times , change routes.", "Multiple attackers. Don\u2019t believe me, look at the pulses. Caged in by male with deauther watch.", "Most of the people doing this are 50\u2019s plus, plus. There are youngsters but many grey haired , grandparents", "The older the smarter the way better. These people are brilliant , ruthless and dangerous", "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.", "Malicious activity seen since a Pulse regarding school outage.", "Location search was used to find device users address. It\u2019s with me.", "Delete service is being used on this Threat service", "Many indicators point to an IP this block is on.", "It\u2019s so out of hand,m for 16 people.", "https://prometheus-pushgateway-internal.preview.tp-staging.com/", "prometheus.netmaker.vonnue.dev", "prometheus.dev.aws.finoa.io", "Prometheus - Alien God? Morality through the eyes of the immoral", "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2879, "domain": 1372, "URL": 5788, "FileHash-SHA256": 1720, "CVE": 1, "FileHash-MD5": 238, "FileHash-SHA1": 241, "email": 13 }, "indicator_count": 12252, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2db3a16fcfd7d323f105b", "name": "[ https://] bethesda[.]net - Spyware", "description": "Bethesda net | Appears as a Gaming platform - Steam ~ | Is Offensive Security | \n\n(cloudfront.net)\n\nName :Legal Department\nName Servers :NS-1306.AWSDNS-35.ORG\n3.163.24.4\nReverse DNS\nserver-3-163-24-4.hio52.r.cloudfront.net\nLocation:\nUnited States of America\nASN :\nASNone\nPositive: bad traffic, spyware \nRelated Tags from 325+\nPulses some may no longer be relevant just related : Spyware\n, \nTrojan\n, \nPegasus\n, \nDNS\n, \nGraphite\n, \nParagon\n, \nNSO\n, \nNSO Group\n, \nSecurity\n, \nSamsung\n, \nGoogle\n, \nAmazon\n, \nHP\n, \nCloudflare\n, \nEndgame\n, \nEurope\n, \nEspionage\n, \nMalware\n | (Seen before: \nhelixcloud.ch)\nI\u2019d like a a try pulse from OTX , not possible , page kept refreshing\u2026", "modified": "2025-11-04T20:00:18.711000", "created": "2025-10-05T20:55:22.423000", "tags": [ "present aug", "present jun", "united", "present sep", "status", "present jul", "elder scrolls", "aaaa", "present oct", "creation date", "body", "date", "fallout", "evil", "title", "server", "domain status", "registrar abuse", "dnssec", "domain name", "contact email", "contact phone", "registrar iana", "host name", "handle", "rdap database", "iana registrar", "entity roles", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "cus oamazon", "cnamazon rsa", "m03 validity", "subject public", "key info", "record type", "ttl value", "india unknown", "present dec", "a domains", "script urls", "search", "present may", "present apr", "present mar", "present feb", "service", "meta", "encrypt", "passive dns", "entries", "title error", "ipv4 add", "pulse pulses", "urls", "files", "reverse dns", "location united", "trojan", "servers", "name servers", "hostname add", "ip address", "domain", "showing", "spyware", "pegasus", "graphite", "paragon", "nso group", "security", "samsung", "google", "amazon", "malware", "nso", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "mitre att", "ck techniques", "copy md5", "copy sha1", "copy sha256", "sha256", "sha1", "script", "ascii text", "pattern match", "null", "refresh", "starfield", "heretic", "doom", "span", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "code", "look", "verify", "restart" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "NSO", "display_name": "NSO", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 69, "FileHash-SHA1": 79, "FileHash-SHA256": 322, "email": 6, "hostname": 1577, "URL": 4971, "domain": 927 }, "indicator_count": 7951, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2e68815e273bfc30a2331", "name": "NSO Group \u2022 OTX Auto Pulse \u2022 bethesda[.]net ", "description": "", "modified": "2025-11-04T20:00:18.711000", "created": "2025-10-05T21:43:36.998000", "tags": [ "present aug", "present jun", "united", "present sep", "status", "present jul", "elder scrolls", "aaaa", "present oct", "creation date", "body", "date", "fallout", "evil", "title", "server", "domain status", "registrar abuse", "dnssec", "domain name", "contact email", "contact phone", "registrar iana", "host name", "handle", "rdap database", "iana registrar", "entity roles", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "cus oamazon", "cnamazon rsa", "m03 validity", "subject public", "key info", "record type", "ttl value", "india unknown", "present dec", "a domains", "script urls", "search", "present may", "present apr", "present mar", "present feb", "service", "meta", "encrypt", "passive dns", "entries", "title error", "ipv4 add", "pulse pulses", "urls", "files", "reverse dns", "location united", "trojan", "servers", "name servers", "hostname add", "ip address", "domain", "showing", "spyware", "pegasus", "graphite", "paragon", "nso group", "security", "samsung", "google", "amazon", "malware", "nso", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "mitre att", "ck techniques", "copy md5", "copy sha1", "copy sha256", "sha256", "sha1", "script", "ascii text", "pattern match", "null", "refresh", "starfield", "heretic", "doom", "span", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "code", "look", "verify", "restart" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "NSO", "display_name": "NSO", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" } ], "industries": [], "TLP": "green", "cloned_from": "68e2db3a16fcfd7d323f105b", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 69, "FileHash-SHA1": 79, "FileHash-SHA256": 322, "email": 6, "hostname": 1577, "URL": 4971, "domain": 927 }, "indicator_count": 7951, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..", "https://l.us-1.a.mimecastprotect.com/l", "IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure", "Delete service is being used on this Threat service", "Prometheus - Alien God? Morality through the eyes of the immoral", "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com", "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact", "The older the smarter the way better. These people are brilliant , ruthless and dangerous", "It\u2019s so out of hand,m for 16 people.", "df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word", "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators", "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80", "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp", "It appears there are 5-7 known affected that I was able to find", "Page Title: \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN", "https://discussions.apple.com/thread/255214328?sortBy=rank", "div>

", "https://prometheus-pushgateway-internal.preview.tp-staging.com/", "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp", "prometheus.dev.aws.finoa.io", "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com", "Malicious activity seen since a Pulse regarding school outage.", "I apologize for the lack of reference.", "Will pulse remaining Apple IoC\u2019s in next pulse", "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com", "https://ww41.porn25.com/", "computersandsoftware \u2022 portal sites \u2022 search engines and portals", "Requires further research.", "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com", "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org Domain kinkfuck.com \u2022 nobodycares.art", "Nippon Telegraph and Telephone Corporation one governmental now privated", "support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^", "Most of the people doing this are 50\u2019s plus, plus. There are youngsters but many grey haired , grandparents", "Same legal , and quasi governmental pattern identified", "Target was monitored in store and followed home needed to stop multiple times , change routes.", "server-3-164-143-102.nrt20.r.cloudfront.net", "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA", "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2", "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5", "Other constitutional rights and privileges written in law where severe courses of action is allowed", "Location search was used to find device users address. It\u2019s with me.", "prometheus.netmaker.vonnue.dev", "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com", "ocn.ad.jp - Registrant Org: NTT Communications Corporation", "Multiple attackers. Don\u2019t believe me, look at the pulses. Caged in by male with deauther watch.", "If something curious is found on privatelybowen property we have a constitutional right to examine it.", "Many indicators point to an IP this block is on.", "Attempts to clip target at high rate of speed.Seen again at her residence in October", "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God.", "This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching", "Device targeted with l RMS Modules by male in Denver, Co", "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.", "swarm-foundry.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Mydoom", "Icedid", "#lowfi:lua:dllsuspiciousexport.a", "Trojan:win32/smkldr.h!mtb", "Nso" ], "industries": [ "Technology", "Telecom", "Legal" ], "unique_indicators": 33022 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/awsdns-16.org", "whois": "http://whois.domaintools.com/awsdns-16.org", "domain": "awsdns-16.org", "hostname": "ns-1158.awsdns-16.org" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "699b907c5375efb7ce1639b8", "name": "Apple Redirects in Apple Support = IcedID | MITM attack", "description": "Researching targets former iPhone. Redirect in Apple support. [support.apple.com/ht^*^ redirects to support.apple.com/de/^*^*^] IcedID identified. | Environment: 3 -5 suspected compromised devices present. Behavior: iPhone reset itself twice, deleted passcodes, required new passcodes, compromised contacts notified target added a new device (FALSE) , threat actor stole Apple cash , added , Password storage, reset television. Targeted another device auto downloaded a Mimecast compromise, attached to iCloud , corrupted files downloaded. Emotet identified. Reset SmartTV. Browser bar AI: mood swings. Overt changes, white screen, pink screens, thread erased. Identified OTX. as a honeypot also states it\u2019s legitimate. I dumped information. AI agents focused on victim leaving shreds of evidence , paper trail , w/ anyone ,anywhere. AI model told truth \u2018I don\u2019t like you , you\u2019ve changed, you lied, you changed all facts .\u201d,etc. An acceptable baseline of communication established . #botnet #command_and_control #IcedID", "modified": "2026-03-24T21:11:04.306000", "created": "2026-02-22T23:25:48.722000", "tags": [ "dynamicloader", "tls handshake", "failure", "whitelisted", "akamai", "yara detections", "trojan", "write", "zeppelin", "malware", "hostile", "unknown", "port", "destination", "read c", "united", "as16625 akamai", "win32", "persistence", "execution", "passive dns", "urls", "otx logo", "all url", "http", "ip address", "related nids", "files location", "win32mydoom feb", "name servers", "servers", "worm", "virtool", "files", "ipv4", "reverse dns", "america flag", "america asn", "United States", "unknown ns", "asn as714", "invalid url", "mtb oct", "mtb sep", "lowfi", "trojanspy", "total", "push", "defender", "china unknown", "mtb apr", "ok server", "gmt content", "type", "accept", "show", "todo", "all filehash", "av detections", "shift", "url http", "url https", "hostname", "type indicator", "source hostname", "writeconsolew", "post https", "tlsv1", "medium", "write c", "dock", "command", "control", "icedid", "domain", "all domain", "status", "hostname add", "crlf line", "unicode text", "utf8", "ee fc", "yara rule", "ff d5", "ascii text", "f0 ff", "eb e1", "music", "next", "autorun", "suspicious", "compatibility", "mode", "entries", "lredmond", "stwashington", "search", "tls sni", "denmark", "body html", "head title", "title head", "body h1", "all ipv4", "url analysis", "users", "ff ff", "files domain", "files related", "url add", "flag united", "present apr", "location united", "asn asnone", "as16509", "moved", "title", "body", "code", "mydoom", "bot net", "mitm", "aquire", "hidden users", "no expiration", "filehashsha256", "expiration", "showing", "indicator role", "pulses url", "pulse show", "iot", "Iced iced baby" ], "references": [ "support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^", "This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching", "IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure", "df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word", "div>

", "Same legal , and quasi governmental pattern identified", "I apologize for the lack of reference.", "Requires further research.", "Will pulse remaining Apple IoC\u2019s in next pulse", "https://l.us-1.a.mimecastprotect.com/l", "It appears there are 5-7 known affected that I was able to find" ], "public": 1, "adversary": "", "targeted_countries": [ "Germany", "Denmark", "United States of America", "Japan" ], "malware_families": [ { "id": "Icedid", "display_name": "Icedid", "target": null }, { "id": "Trojan:Win32/SmkLdr.H!MTB", "display_name": "Trojan:Win32/SmkLdr.H!MTB", "target": "/malware/Trojan:Win32/SmkLdr.H!MTB" }, { "id": "#Lowfi:Lua:DllSuspiciousExport.A", "display_name": "#Lowfi:Lua:DllSuspiciousExport.A", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1608.001", "name": "Upload Malware", "display_name": "T1608.001 - Upload Malware" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1557", "name": "Man-in-the-Middle", "display_name": "T1557 - Man-in-the-Middle" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Telecom", "Legal" ], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2051, "FileHash-SHA256": 1706, "URL": 6984, "domain": 1097, "FileHash-MD5": 401, "FileHash-SHA1": 276, "SSLCertFingerprint": 9, "email": 13, "CVE": 1 }, "indicator_count": 12538, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "69 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6958372ef9da31513d96bebb", "name": "Connected-IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation", "description": "Retaliation? IOS remotely connected to 180.4.1.2 \u2022 ocn.ad.jp -NTT Communications Corporation for malicious control | found in the analytics of a highly target device: I\u2019ve included related pulses from 2 other threat responders and an Apple discussion post. Surprisingly, most of the IoC\u2019s pulsed came from one page of analytics. | \u2022 \"avconferenced\", \"procPath\" : \"\\/usr\\/libexec\\/avconferenced | 180.4.1.2 | a version of\npegasus found. | https://prometheus-pushgateway-internal.preview.tp-staging.com/\t\nhostname: prometheus.netmaker.vonnue.dev\t\nhostname: prometheus.dev.aws.finoa.io |\nSince Prometheus pulse . I realize now every Prometheus pulse illicits outrageous behavior.. Is this a secret society? Try to be more secretive. Owl heads in lawn. This behavior illicits investigation for a fix. Please STOP. I\u2019m done looking at Prometheus. Please stop leaving artifacts.", "modified": "2026-02-01T20:00:08.812000", "created": "2026-01-02T21:22:54.247000", "tags": [ "syscall", "nsrunloop", "objcclass", "region type", "start", "vsize", "prtmax shrmod", "region detailn", "unused space", "at startn", "guard", "urls", "url analysis", "verdict", "domain", "address", "location japan", "hikone", "japan asn", "as4713 ntt", "related tags", "none external", "aaaa", "united", "passive dns", "ip address", "japan", "present dec", "domain add", "files", "japan unknown", "present jul", "present oct", "present sep", "present aug", "present jun", "japan showing", "urls show", "date checked", "url hostname", "server response", "google safe", "reverse dns", "present nov", "present", "present may", "present mar", "present apr", "data upload", "extraction", "failed", "files ip", "moved", "gmt content", "ipv4 add", "location united", "title", "ipv4", "dns resolutions", "hostname add", "asn as4713", "all ipv4", "google", "ocn ntt", "googlecl", "http", "amazon02", "akamaias", "page url", "yahoojp", "december", "jp summary", "february", "asn15169", "tokyo", "kansas city", "asn396982", "asn30286", "asn16509", "cisco", "umbrella rank", "cisco umbrella", "rank", "kitashinagawa", "sureserver ev", "ca g3", "domains", "hashes", "microsoft", "docomo business", "ml14325", "as autonomous", "asn8075", "ip information", "ipasns ip", "detail domain", "domain tree", "links domain", "requested", "value", "automatic", "webgl", "please", "mr value", "muid value", "mjl function", "dcmlinker", "paq string", "kb script", "b image", "b script", "frame a344", "redirect chain", "kb document", "frame", "b xhr", "kb image", "fetch collect", "request chain", "redirected", "http redirect", "name servers", "redacted for", "servers", "unknown aaaa", "search", "for privacy", "domeny serwery", "verdana tahoma", "arial", "gmt contenttype", "meta", "small", "results jan", "present jan", "status", "record value", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "process details", "flag", "japan japan", "pattern match", "ascii text", "mitre att", "ck id", "null", "refresh", "span", "hybrid", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "learn", "name tactics", "suspicious", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "monitored target", "pulse submit", "wikipedia", "imap", "smtp", "ocn open", "discussion", "stub", "jprs database", "ocnnttocn", "maintenance", "outages notice", "lock status", "state", "connected", "organization", "type", "name", "server", "name server", "connected date", "algorithm", "key identifier", "data", "v3 serial", "number", "cjp ocybertrust", "ev ca", "g3 validity", "ku ontt", "docomo", "record type", "ttl value", "thumbprint", "emails", "date", "trojan", "pegasus", "title error", "hostname", "pulse pulses", "entries", "mtb apr", "lowfi", "win32", "a domains", "body", "worm", "virtool", "cybota", "showing", "palantir", "prometheus" ], "references": [ "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp", "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp", "ocn.ad.jp - Registrant Org: NTT Communications Corporation", "Page Title: \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN", "Nippon Telegraph and Telephone Corporation one governmental now privated", "computersandsoftware \u2022 portal sites \u2022 search engines and portals", "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com", "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2", "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80", "https://discussions.apple.com/thread/255214328?sortBy=rank", "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators", "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact", "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com", "swarm-foundry.com", "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org Domain kinkfuck.com \u2022 nobodycares.art", "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com", "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5", "server-3-164-143-102.nrt20.r.cloudfront.net", "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com", "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com", "https://ww41.porn25.com/", "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA", "If something curious is found on privatelybowen property we have a constitutional right to examine it.", "Other constitutional rights and privileges written in law where severe courses of action is allowed", "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..", "Device targeted with l RMS Modules by male in Denver, Co", "Attempts to clip target at high rate of speed.Seen again at her residence in October", "Target was monitored in store and followed home needed to stop multiple times , change routes.", "Multiple attackers. Don\u2019t believe me, look at the pulses. Caged in by male with deauther watch.", "Most of the people doing this are 50\u2019s plus, plus. There are youngsters but many grey haired , grandparents", "The older the smarter the way better. These people are brilliant , ruthless and dangerous", "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.", "Malicious activity seen since a Pulse regarding school outage.", "Location search was used to find device users address. It\u2019s with me.", "Delete service is being used on this Threat service", "Many indicators point to an IP this block is on.", "It\u2019s so out of hand,m for 16 people.", "https://prometheus-pushgateway-internal.preview.tp-staging.com/", "prometheus.netmaker.vonnue.dev", "prometheus.dev.aws.finoa.io", "Prometheus - Alien God? Morality through the eyes of the immoral", "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2879, "domain": 1372, "URL": 5788, "FileHash-SHA256": 1720, "CVE": 1, "FileHash-MD5": 238, "FileHash-SHA1": 241, "email": 13 }, "indicator_count": 12252, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2db3a16fcfd7d323f105b", "name": "[ https://] bethesda[.]net - Spyware", "description": "Bethesda net | Appears as a Gaming platform - Steam ~ | Is Offensive Security | \n\n(cloudfront.net)\n\nName :Legal Department\nName Servers :NS-1306.AWSDNS-35.ORG\n3.163.24.4\nReverse DNS\nserver-3-163-24-4.hio52.r.cloudfront.net\nLocation:\nUnited States of America\nASN :\nASNone\nPositive: bad traffic, spyware \nRelated Tags from 325+\nPulses some may no longer be relevant just related : Spyware\n, \nTrojan\n, \nPegasus\n, \nDNS\n, \nGraphite\n, \nParagon\n, \nNSO\n, \nNSO Group\n, \nSecurity\n, \nSamsung\n, \nGoogle\n, \nAmazon\n, \nHP\n, \nCloudflare\n, \nEndgame\n, \nEurope\n, \nEspionage\n, \nMalware\n | (Seen before: \nhelixcloud.ch)\nI\u2019d like a a try pulse from OTX , not possible , page kept refreshing\u2026", "modified": "2025-11-04T20:00:18.711000", "created": "2025-10-05T20:55:22.423000", "tags": [ "present aug", "present jun", "united", "present sep", "status", "present jul", "elder scrolls", "aaaa", "present oct", "creation date", "body", "date", "fallout", "evil", "title", "server", "domain status", "registrar abuse", "dnssec", "domain name", "contact email", "contact phone", "registrar iana", "host name", "handle", "rdap database", "iana registrar", "entity roles", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "cus oamazon", "cnamazon rsa", "m03 validity", "subject public", "key info", "record type", "ttl value", "india unknown", "present dec", "a domains", "script urls", "search", "present may", "present apr", "present mar", "present feb", "service", "meta", "encrypt", "passive dns", "entries", "title error", "ipv4 add", "pulse pulses", "urls", "files", "reverse dns", "location united", "trojan", "servers", "name servers", "hostname add", "ip address", "domain", "showing", "spyware", "pegasus", "graphite", "paragon", "nso group", "security", "samsung", "google", "amazon", "malware", "nso", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "mitre att", "ck techniques", "copy md5", "copy sha1", "copy sha256", "sha256", "sha1", "script", "ascii text", "pattern match", "null", "refresh", "starfield", "heretic", "doom", "span", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "code", "look", "verify", "restart" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "NSO", "display_name": "NSO", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 69, "FileHash-SHA1": 79, "FileHash-SHA256": 322, "email": 6, "hostname": 1577, "URL": 4971, "domain": 927 }, "indicator_count": 7951, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2e68815e273bfc30a2331", "name": "NSO Group \u2022 OTX Auto Pulse \u2022 bethesda[.]net ", "description": "", "modified": "2025-11-04T20:00:18.711000", "created": "2025-10-05T21:43:36.998000", "tags": [ "present aug", "present jun", "united", "present sep", "status", "present jul", "elder scrolls", "aaaa", "present oct", "creation date", "body", "date", "fallout", "evil", "title", "server", "domain status", "registrar abuse", "dnssec", "domain name", "contact email", "contact phone", "registrar iana", "host name", "handle", "rdap database", "iana registrar", "entity roles", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "cus oamazon", "cnamazon rsa", "m03 validity", "subject public", "key info", "record type", "ttl value", "india unknown", "present dec", "a domains", "script urls", "search", "present may", "present apr", "present mar", "present feb", "service", "meta", "encrypt", "passive dns", "entries", "title error", "ipv4 add", "pulse pulses", "urls", "files", "reverse dns", "location united", "trojan", "servers", "name servers", "hostname add", "ip address", "domain", "showing", "spyware", "pegasus", "graphite", "paragon", "nso group", "security", "samsung", "google", "amazon", "malware", "nso", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "mitre att", "ck techniques", "copy md5", "copy sha1", "copy sha256", "sha256", "sha1", "script", "ascii text", "pattern match", "null", "refresh", "starfield", "heretic", "doom", "span", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "code", "look", "verify", "restart" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "NSO", "display_name": "NSO", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" } ], "industries": [], "TLP": "green", "cloned_from": "68e2db3a16fcfd7d323f105b", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 69, "FileHash-SHA1": 79, "FileHash-SHA256": 322, "email": 6, "hostname": 1577, "URL": 4971, "domain": 927 }, "indicator_count": 7951, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://ns-1158.awsdns-16.org/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://ns-1158.awsdns-16.org/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780353860.2085526 }