{
  "type": "URL",
  "indicator": "https://ns-497.awsdns-62.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ns-497.awsdns-62.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4097031563,
      "indicator": "https://ns-497.awsdns-62.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "693cdc5b8ebc10664439c2fb",
          "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - Freeman Mathis & Gary for The State of Colorado",
          "description": "State of Colorado attackers use  DGA domains set up multiple Law Firms.. Christopher P.  \u2019Buzz\u2019  Ahmann  Is a legal consultant / attorney./ hacker \nWorks for the State of Colorado/ quasi. Is malicious and doesn\u2019t work alone. Continues to target \nState had relative contacted by a fake entity \u2018Goodness Health\u2019\nLeft vague VM for relative message \u201cWe work on the Medicare side of things.\u201d and? \nSocial engineering call , malicious domain. The State of Colorado has been on a relentless pursuit against target. Fully compromised targets relatives brand new phone. Hacked target since 10/2013.\nMultiple cyber and physical attacks carried out  against target and family members.. There are attacks make  to look like accidents or malfunctions. This harmful, silencing behavior is somehow illegal for anyone else.",
          "modified": "2026-02-10T06:05:39.764000",
          "created": "2025-12-13T03:24:11.414000",
          "tags": [
            "colorado state",
            "freeman mathis",
            "history",
            "cyber risk",
            "aspen insureds",
            "gaig insureds",
            "landy insureds",
            "nip group",
            "purm insureds",
            "overview core",
            "united",
            "ip address",
            "present nov",
            "present may",
            "moved",
            "encrypt",
            "unknown",
            "backdoor",
            "passive dns",
            "ransom",
            "checkin",
            "trojandropper",
            "mtb nov",
            "twitter",
            "trojan",
            "data upload",
            "extraction",
            "failed",
            "united states",
            "server response",
            "google safe",
            "results may",
            "lowfi",
            "virtool",
            "mtb alf",
            "mh alf",
            "port",
            "windows nt",
            "destination",
            "msie",
            "khtml",
            "gecko",
            "unknown aaaa",
            "a domains",
            "meta",
            "for privacy",
            "cop supply",
            "urls",
            "as139646 hong",
            "hostname",
            "files",
            "hong kong",
            "domain add",
            "ip related",
            "hash avast",
            "avg clamav",
            "msdefender may",
            "ddos",
            "as13335",
            "ipv4",
            "certificate",
            "hostname add",
            "url analysis",
            "files ip",
            "name strings",
            "category",
            "united states",
            "pulse indicator",
            "address",
            "error",
            "null",
            "object",
            "string",
            "number",
            "google maps",
            "promise",
            "javascript api",
            "dataset",
            "bigint",
            "dark",
            "android",
            "infinity",
            "internal",
            "roboto",
            "trident",
            "void",
            "small",
            "lightrail",
            "false",
            "span",
            "close",
            "light",
            "hybrid",
            "embed",
            "iframe",
            "keygen",
            "this",
            "february",
            "bounce",
            "drop",
            "inside",
            "outside",
            "marker",
            "present dec",
            "pulses otx",
            "aaaa",
            "asnone country",
            "record value",
            "title",
            "pulse pulses",
            "pulses",
            "showing",
            "unknown cname",
            "unknown soa",
            "next associated",
            "ipv4 add",
            "cycbot",
            "extract indic",
            "sneaker bots",
            "proxies data",
            "script script",
            "adult content",
            "nextimage",
            "porn site",
            "div div",
            "platform make",
            "cloudfront x",
            "hio52 p3",
            "unknown ns",
            "pulse submit",
            "title error",
            "reverse dns",
            "status",
            "servers",
            "name servers",
            "vashti hostname",
            "scan endpoints",
            "url http",
            "http",
            "files domain",
            "files related",
            "pulses none",
            "dnssec",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "version list",
            "domain",
            "emails",
            "cookie",
            "url https",
            "show",
            "filehash",
            "urls show",
            "date checked",
            "url hostname",
            "results nov",
            "win32",
            "type",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "defense evasion",
            "spawns",
            "flag",
            "llc name",
            "server",
            "markmonitor",
            "name server",
            "windir",
            "openurl c",
            "prefetch2",
            "show technique",
            "mitre att",
            "ck matrix",
            "pattern match",
            "ascii text",
            "sha1",
            "href",
            "show process",
            "file",
            "general",
            "local",
            "path",
            "germany unknown",
            "date",
            "registrar",
            "ip whois",
            "dynamicloader",
            "high",
            "medium",
            "search",
            "displayname",
            "tofsee",
            "win64",
            "write",
            "stream",
            "malware",
            "push",
            "entries",
            "tls handshake",
            "failure",
            "forbidden",
            "tlsv1",
            "april",
            "next",
            "write c",
            "intel",
            "ms windows",
            "sha1 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "sha256 add",
            "present jun",
            "present mar",
            "medelln",
            "colombia asn",
            "dns resolutions",
            "address domain",
            "related tags",
            "none google",
            "safe browsing",
            "external",
            "present sep",
            "present aug",
            "as54113",
            "present jul",
            "as8068",
            "gmt content",
            "total",
            "read",
            "delete",
            "top source",
            "quasi",
            "murderers",
            "christopher ahmann",
            "buzz ahmann",
            "wow64",
            "slcc2",
            "media center",
            "labor",
            "employment",
            "cdle",
            "dowc",
            "colorado",
            "workers",
            "coloradoif",
            "independent",
            "state",
            "company",
            "entity type",
            "authorized line",
            "analysis",
            "tor analysis",
            "process details",
            "network traffic",
            "t1071",
            "potential ip",
            "click",
            "found",
            "t1480 execution",
            "bad traffic",
            "et info",
            "ck techniques",
            "evasion att",
            "t1057",
            "refresh",
            "body",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "cname",
            "form",
            "pulse",
            "script domains",
            "script urls",
            "administrator",
            "services llc",
            "dns admin",
            "domain admin",
            "global llc",
            "domain manager",
            "computer system",
            "ltd domain",
            "network",
            "alibaba",
            "facebook",
            "phishme",
            "sogou",
            "present jan",
            "present feb",
            "present oct"
          ],
          "references": [
            "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
            "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
            "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
            "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
            "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
            "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
            "https://maps.googleapis.com/maps/api/js?sensor=false",
            "cell-0.af-south-1.prod.telemetry.console.api.aws",
            "howtoworkacrickoutofyourneck2.pages.dev",
            "firebase-auth-eich0v.pages.dev",
            "http://ianswertomom.com/develop-wise-woman-within-yourself",
            "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
            "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
            "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
            "https://khmerpornvideo.signup0.y.id/",
            "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
            "https://clear.ml/infrastructure-control-plane",
            "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
            "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
            "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
            "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
            "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
            "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
            "Legal court documented  agreement to allow and pay target to hire cyber investigators",
            "Attacks are being carried out by The State of Colorado"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan",
            "France",
            "Ireland",
            "Spain",
            "Italy",
            "Aruba",
            "Australia",
            "Denmark",
            "United Kingdom of Great Britain and Northern Ireland",
            "Germany",
            "T\u00fcrkiye",
            "Indonesia"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.GravityRAT-6511862-0",
              "display_name": "Win.Trojan.GravityRAT-6511862-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Unix.Trojan.Tsunami-6981155-0",
              "display_name": "Unix.Trojan.Tsunami-6981155-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Systex.A",
              "display_name": "TrojanDropper:Win32/Systex.A",
              "target": "/malware/TrojanDropper:Win32/Systex.A"
            },
            {
              "id": "Win.Trojan.Tepfer-61",
              "display_name": "Win.Trojan.Tepfer-61",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "target": null
            },
            {
              "id": "VirTool:Win32/VBInject.gen!MH",
              "display_name": "VirTool:Win32/VBInject.gen!MH",
              "target": "/malware/VirTool:Win32/VBInject.gen!MH"
            },
            {
              "id": "ALF:NID:Susp_NSIS_Stub.A",
              "display_name": "ALF:NID:Susp_NSIS_Stub.A",
              "target": null
            },
            {
              "id": "#LOWFI:HSTR:Criakl.B1",
              "display_name": "#LOWFI:HSTR:Criakl.B1",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Arwobot.B",
              "display_name": "Backdoor:Win32/Arwobot.B",
              "target": "/malware/Backdoor:Win32/Arwobot.B"
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "Win.Downloader.Small-4507",
              "display_name": "Win.Downloader.Small-4507",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qbot.R!MTB",
              "display_name": "Trojan:Win32/Qbot.R!MTB",
              "target": "/malware/Trojan:Win32/Qbot.R!MTB"
            },
            {
              "id": "Win.Malware.Mikey-9949492-0",
              "display_name": "Win.Malware.Mikey-9949492-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti.A",
              "display_name": "Ransom:Win32/Crowti.A",
              "target": "/malware/Ransom:Win32/Crowti.A"
            },
            {
              "id": "Backdoor:Linux/DemonBot.Aa!MTB",
              "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
              "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
            },
            {
              "id": "Unix.Trojan.Gafgyt-6981154-0",
              "display_name": "Unix.Trojan.Gafgyt-6981154-0",
              "target": null
            },
            {
              "id": "DDOS:Linux/Gafgyt.YA!MTB",
              "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
              "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
            },
            {
              "id": "CVE-2017-11882",
              "display_name": "CVE-2017-11882",
              "target": null
            },
            {
              "id": "ALF:Exploit:O97M/CVE-2017-8977",
              "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
              "target": null
            },
            {
              "id": "Cycbot",
              "display_name": "Cycbot",
              "target": null
            },
            {
              "id": "Win32:BotX-gen\\ [Trj]",
              "display_name": "Win32:BotX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "NIDS",
              "display_name": "NIDS",
              "target": null
            },
            {
              "id": "Mirai (ELF)",
              "display_name": "Mirai (ELF)",
              "target": null
            },
            {
              "id": "Worm",
              "display_name": "Worm",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            }
          ],
          "industries": [
            "Insurance",
            "Construction"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 54118,
            "domain": 11153,
            "hostname": 18578,
            "email": 21,
            "FileHash-SHA256": 4905,
            "FileHash-MD5": 548,
            "FileHash-SHA1": 534,
            "CVE": 7,
            "SSLCertFingerprint": 20,
            "CIDR": 1
          },
          "indicator_count": 89885,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "69 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6963596c4cd594b77b4675ec",
          "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - PalantirFoundry | The State of Colorado | ",
          "description": "",
          "modified": "2026-02-10T06:05:39.764000",
          "created": "2026-01-11T08:03:56.534000",
          "tags": [
            "colorado state",
            "freeman mathis",
            "history",
            "cyber risk",
            "aspen insureds",
            "gaig insureds",
            "landy insureds",
            "nip group",
            "purm insureds",
            "overview core",
            "united",
            "ip address",
            "present nov",
            "present may",
            "moved",
            "encrypt",
            "unknown",
            "backdoor",
            "passive dns",
            "ransom",
            "checkin",
            "trojandropper",
            "mtb nov",
            "twitter",
            "trojan",
            "data upload",
            "extraction",
            "failed",
            "united states",
            "server response",
            "google safe",
            "results may",
            "lowfi",
            "virtool",
            "mtb alf",
            "mh alf",
            "port",
            "windows nt",
            "destination",
            "msie",
            "khtml",
            "gecko",
            "unknown aaaa",
            "a domains",
            "meta",
            "for privacy",
            "cop supply",
            "urls",
            "as139646 hong",
            "hostname",
            "files",
            "hong kong",
            "domain add",
            "ip related",
            "hash avast",
            "avg clamav",
            "msdefender may",
            "ddos",
            "as13335",
            "ipv4",
            "certificate",
            "hostname add",
            "url analysis",
            "files ip",
            "name strings",
            "category",
            "united states",
            "pulse indicator",
            "address",
            "error",
            "null",
            "object",
            "string",
            "number",
            "google maps",
            "promise",
            "javascript api",
            "dataset",
            "bigint",
            "dark",
            "android",
            "infinity",
            "internal",
            "roboto",
            "trident",
            "void",
            "small",
            "lightrail",
            "false",
            "span",
            "close",
            "light",
            "hybrid",
            "embed",
            "iframe",
            "keygen",
            "this",
            "february",
            "bounce",
            "drop",
            "inside",
            "outside",
            "marker",
            "present dec",
            "pulses otx",
            "aaaa",
            "asnone country",
            "record value",
            "title",
            "pulse pulses",
            "pulses",
            "showing",
            "unknown cname",
            "unknown soa",
            "next associated",
            "ipv4 add",
            "cycbot",
            "extract indic",
            "sneaker bots",
            "proxies data",
            "script script",
            "adult content",
            "nextimage",
            "porn site",
            "div div",
            "platform make",
            "cloudfront x",
            "hio52 p3",
            "unknown ns",
            "pulse submit",
            "title error",
            "reverse dns",
            "status",
            "servers",
            "name servers",
            "vashti hostname",
            "scan endpoints",
            "url http",
            "http",
            "files domain",
            "files related",
            "pulses none",
            "dnssec",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "version list",
            "domain",
            "emails",
            "cookie",
            "url https",
            "show",
            "filehash",
            "urls show",
            "date checked",
            "url hostname",
            "results nov",
            "win32",
            "type",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "defense evasion",
            "spawns",
            "flag",
            "llc name",
            "server",
            "markmonitor",
            "name server",
            "windir",
            "openurl c",
            "prefetch2",
            "show technique",
            "mitre att",
            "ck matrix",
            "pattern match",
            "ascii text",
            "sha1",
            "href",
            "show process",
            "file",
            "general",
            "local",
            "path",
            "germany unknown",
            "date",
            "registrar",
            "ip whois",
            "dynamicloader",
            "high",
            "medium",
            "search",
            "displayname",
            "tofsee",
            "win64",
            "write",
            "stream",
            "malware",
            "push",
            "entries",
            "tls handshake",
            "failure",
            "forbidden",
            "tlsv1",
            "april",
            "next",
            "write c",
            "intel",
            "ms windows",
            "sha1 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "sha256 add",
            "present jun",
            "present mar",
            "medelln",
            "colombia asn",
            "dns resolutions",
            "address domain",
            "related tags",
            "none google",
            "safe browsing",
            "external",
            "present sep",
            "present aug",
            "as54113",
            "present jul",
            "as8068",
            "gmt content",
            "total",
            "read",
            "delete",
            "top source",
            "quasi",
            "murderers",
            "christopher ahmann",
            "buzz ahmann",
            "wow64",
            "slcc2",
            "media center",
            "labor",
            "employment",
            "cdle",
            "dowc",
            "colorado",
            "workers",
            "coloradoif",
            "independent",
            "state",
            "company",
            "entity type",
            "authorized line",
            "analysis",
            "tor analysis",
            "process details",
            "network traffic",
            "t1071",
            "potential ip",
            "click",
            "found",
            "t1480 execution",
            "bad traffic",
            "et info",
            "ck techniques",
            "evasion att",
            "t1057",
            "refresh",
            "body",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "cname",
            "form",
            "pulse",
            "script domains",
            "script urls",
            "administrator",
            "services llc",
            "dns admin",
            "domain admin",
            "global llc",
            "domain manager",
            "computer system",
            "ltd domain",
            "network",
            "alibaba",
            "facebook",
            "phishme",
            "sogou",
            "present jan",
            "present feb",
            "present oct"
          ],
          "references": [
            "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
            "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
            "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
            "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
            "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
            "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
            "https://maps.googleapis.com/maps/api/js?sensor=false",
            "cell-0.af-south-1.prod.telemetry.console.api.aws",
            "howtoworkacrickoutofyourneck2.pages.dev",
            "firebase-auth-eich0v.pages.dev",
            "http://ianswertomom.com/develop-wise-woman-within-yourself",
            "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
            "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
            "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
            "https://khmerpornvideo.signup0.y.id/",
            "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
            "https://clear.ml/infrastructure-control-plane",
            "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
            "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
            "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
            "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
            "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
            "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
            "Legal court documented  agreement to allow and pay target to hire cyber investigators",
            "Attacks are being carried out by The State of Colorado"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan",
            "France",
            "Ireland",
            "Spain",
            "Italy",
            "Aruba",
            "Australia",
            "Denmark",
            "United Kingdom of Great Britain and Northern Ireland",
            "Germany",
            "T\u00fcrkiye",
            "Indonesia"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.GravityRAT-6511862-0",
              "display_name": "Win.Trojan.GravityRAT-6511862-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Unix.Trojan.Tsunami-6981155-0",
              "display_name": "Unix.Trojan.Tsunami-6981155-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Systex.A",
              "display_name": "TrojanDropper:Win32/Systex.A",
              "target": "/malware/TrojanDropper:Win32/Systex.A"
            },
            {
              "id": "Win.Trojan.Tepfer-61",
              "display_name": "Win.Trojan.Tepfer-61",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "target": null
            },
            {
              "id": "VirTool:Win32/VBInject.gen!MH",
              "display_name": "VirTool:Win32/VBInject.gen!MH",
              "target": "/malware/VirTool:Win32/VBInject.gen!MH"
            },
            {
              "id": "ALF:NID:Susp_NSIS_Stub.A",
              "display_name": "ALF:NID:Susp_NSIS_Stub.A",
              "target": null
            },
            {
              "id": "#LOWFI:HSTR:Criakl.B1",
              "display_name": "#LOWFI:HSTR:Criakl.B1",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Arwobot.B",
              "display_name": "Backdoor:Win32/Arwobot.B",
              "target": "/malware/Backdoor:Win32/Arwobot.B"
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "Win.Downloader.Small-4507",
              "display_name": "Win.Downloader.Small-4507",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qbot.R!MTB",
              "display_name": "Trojan:Win32/Qbot.R!MTB",
              "target": "/malware/Trojan:Win32/Qbot.R!MTB"
            },
            {
              "id": "Win.Malware.Mikey-9949492-0",
              "display_name": "Win.Malware.Mikey-9949492-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti.A",
              "display_name": "Ransom:Win32/Crowti.A",
              "target": "/malware/Ransom:Win32/Crowti.A"
            },
            {
              "id": "Backdoor:Linux/DemonBot.Aa!MTB",
              "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
              "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
            },
            {
              "id": "Unix.Trojan.Gafgyt-6981154-0",
              "display_name": "Unix.Trojan.Gafgyt-6981154-0",
              "target": null
            },
            {
              "id": "DDOS:Linux/Gafgyt.YA!MTB",
              "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
              "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
            },
            {
              "id": "CVE-2017-11882",
              "display_name": "CVE-2017-11882",
              "target": null
            },
            {
              "id": "ALF:Exploit:O97M/CVE-2017-8977",
              "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
              "target": null
            },
            {
              "id": "Cycbot",
              "display_name": "Cycbot",
              "target": null
            },
            {
              "id": "Win32:BotX-gen\\ [Trj]",
              "display_name": "Win32:BotX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "NIDS",
              "display_name": "NIDS",
              "target": null
            },
            {
              "id": "Mirai (ELF)",
              "display_name": "Mirai (ELF)",
              "target": null
            },
            {
              "id": "Worm",
              "display_name": "Worm",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            }
          ],
          "industries": [
            "Insurance",
            "Construction"
          ],
          "TLP": "green",
          "cloned_from": "693cdc5b8ebc10664439c2fb",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 54118,
            "domain": 11153,
            "hostname": 18578,
            "email": 21,
            "FileHash-SHA256": 4905,
            "FileHash-MD5": 548,
            "FileHash-SHA1": 534,
            "CVE": 7,
            "SSLCertFingerprint": 20,
            "CIDR": 1
          },
          "indicator_count": 89885,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "69 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6894f30905efa56990bb10f6",
          "name": "Expanded device-local-****remotewd.com",
          "description": "device-local-2ffdbd74-9f90-41fa-beb8-454ed65788c5.remotewd.com",
          "modified": "2025-09-06T06:03:31.462000",
          "created": "2025-08-07T18:40:09.876000",
          "tags": [
            "hostname",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "nameservers",
            "date hash",
            "avast avg",
            "entries",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "itre att",
            "ck techniques",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "domain",
            "hostname add",
            "files ip",
            "address",
            "location united",
            "hash avast",
            "avg clamav",
            "msdefender aug",
            "united",
            "port",
            "destination",
            "as16509",
            "search",
            "unknown",
            "ocloudflare",
            "medium",
            "memcommit",
            "service",
            "write",
            "next",
            "persistence",
            "execution",
            "malware",
            "copy",
            "encrypt",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "next associated",
            "urls show",
            "date checked",
            "virtool",
            "win64",
            "worm",
            "mtb may",
            "files show",
            "heur",
            "script",
            "dropper",
            "ransom",
            "vitro",
            "pe32",
            "intel",
            "ms windows",
            "as15169",
            "read c",
            "asnone",
            "show",
            "packing t1045",
            "t1045",
            "delphi",
            "code",
            "june"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6741,
            "domain": 5822,
            "FileHash-SHA256": 1550,
            "URL": 16348,
            "FileHash-MD5": 287,
            "FileHash-SHA1": 242,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 31000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6894f4e6c41982f405592b55",
          "name": "Worm:Win32/Mydoom | Expanded device-local-****remotewd.com",
          "description": "",
          "modified": "2025-09-06T06:03:31.462000",
          "created": "2025-08-07T18:48:06.557000",
          "tags": [
            "hostname",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "nameservers",
            "date hash",
            "avast avg",
            "entries",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "itre att",
            "ck techniques",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "domain",
            "hostname add",
            "files ip",
            "address",
            "location united",
            "hash avast",
            "avg clamav",
            "msdefender aug",
            "united",
            "port",
            "destination",
            "as16509",
            "search",
            "unknown",
            "ocloudflare",
            "medium",
            "memcommit",
            "service",
            "write",
            "next",
            "persistence",
            "execution",
            "malware",
            "copy",
            "encrypt",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "next associated",
            "urls show",
            "date checked",
            "virtool",
            "win64",
            "worm",
            "mtb may",
            "files show",
            "heur",
            "script",
            "dropper",
            "ransom",
            "vitro",
            "pe32",
            "intel",
            "ms windows",
            "as15169",
            "read c",
            "asnone",
            "show",
            "packing t1045",
            "t1045",
            "delphi",
            "code",
            "june"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6894f30905efa56990bb10f6",
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6741,
            "domain": 5822,
            "FileHash-SHA256": 1550,
            "URL": 16348,
            "FileHash-MD5": 287,
            "FileHash-SHA1": 242,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 31000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68923ea4efbf58b7ba48acec",
          "name": "Hosted App",
          "description": "",
          "modified": "2025-09-04T16:03:17.037000",
          "created": "2025-08-05T17:25:56.454000",
          "tags": [
            "issuer wr3",
            "log id",
            "gmtn",
            "abn timestamp",
            "ad180b80",
            "full name",
            "extensionsstr",
            "web server",
            "ca issuers",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "mitre att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "ascii text",
            "pattern match",
            "show technique",
            "date",
            "format",
            "august",
            "hybrid",
            "local",
            "path",
            "click",
            "strings",
            "flag",
            "usa windows",
            "hwp support",
            "march",
            "december",
            "united",
            "markmonitor",
            "overview dns",
            "requests domain",
            "country",
            "contacted hosts",
            "ip address",
            "process details",
            "t1179 hooking",
            "access windows",
            "installs",
            "control att",
            "found",
            "development att",
            "name server",
            "show process",
            "programfiles",
            "command decode",
            "suricata ipv4",
            "ck matrix",
            "comspec",
            "model",
            "general",
            "dynamicloader",
            "unknown",
            "as16509",
            "whitelisted",
            "medium",
            "write c",
            "as15169",
            "search",
            "high",
            "write",
            "android",
            "malware",
            "copy",
            "next",
            "formbook cnc",
            "checkin",
            "entries",
            "passive dns",
            "next associated",
            "site",
            "neue",
            "ipv4",
            "pulse pulses",
            "exploit",
            "trojan",
            "virtool",
            "body",
            "refer",
            "present dec",
            "epub",
            "present jan",
            "present nov",
            "present oct",
            "showing",
            "urls show",
            "win32",
            "win64",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "prefetch8",
            "localappdata",
            "prefetch1"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3409,
            "hostname": 4127,
            "URL": 8408,
            "SSLCertFingerprint": 9,
            "FileHash-SHA256": 1175,
            "FileHash-MD5": 144,
            "FileHash-SHA1": 134,
            "CVE": 2
          },
          "indicator_count": 17408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "228 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687c07591d641de3c896d4a9",
          "name": "icon.palantirfoundry.com - Brazzers Porn",
          "description": "Another strange pulse. Persistent bad actors moved and changed name of operation; of course. Usual - Hostname\nicon.palantirfoundry.com , Apple, Samsung , X.com , Twitter , Facebook, Google, Palantir NSA or a poser? I was threatened this week, I was told that if I was on the \u2018list\u2019 they have to do anything that is asked including \u2018blow me up\u2019. Sounds nuts but I can\u2019t believe this. Whoever has been doing this is hyper dangerous.\n\nicon.palantirfoundry.com ?  P.S. Huge pulse. Can\u2019t use private option to cherry pick the IoC\u2019s I\u2019d like to breakdown. Have I broken a rule?",
          "modified": "2025-08-18T18:01:11.130000",
          "created": "2025-07-19T21:00:09.343000",
          "tags": [
            "canada unknown",
            "passive dns",
            "ransom",
            "entries",
            "ipv4",
            "pulse submit",
            "url analysis",
            "urls",
            "files",
            "reverse dns",
            "united",
            "unknown ns",
            "moved",
            "ip address",
            "creation date",
            "search",
            "omain",
            "pulse pulses",
            "body",
            "date",
            "showing",
            "domain",
            "hostname",
            "ocloudflare",
            "stca",
            "lsan francisco",
            "ecc ca3",
            "ecc ca2",
            "as16509",
            "unknown",
            "ms windows",
            "encrypt",
            "write",
            "next",
            "service",
            "malware",
            "copy",
            "unknown soa",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "present jan",
            "medium",
            "memcommit",
            "module load",
            "t1129",
            "regopenkeyexw",
            "fjlsedauv",
            "et useragents",
            "go http",
            "registry run",
            "persistence",
            "execution",
            "checks",
            "keys",
            "start folder",
            "richhash",
            "external",
            "virustotal api",
            "screenshots",
            "find",
            "show",
            "types",
            "seard type",
            "indicator",
            "data upload",
            "extraction",
            "failed",
            "sc data",
            "type",
            "extri included",
            "review data",
            "sugges data",
            "find suxxesteu",
            "typ indicalon"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 62,
            "FileHash-SHA1": 17,
            "FileHash-SHA256": 1433,
            "URL": 10188,
            "hostname": 5658,
            "domain": 5753,
            "email": 4,
            "SSLCertFingerprint": 20
          },
          "indicator_count": 23135,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "245 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://maps.googleapis.com/maps/api/js?sensor=false",
        "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
        "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
        "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
        "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
        "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
        "Legal court documented  agreement to allow and pay target to hire cyber investigators",
        "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
        "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
        "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
        "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
        "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
        "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
        "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
        "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
        "cell-0.af-south-1.prod.telemetry.console.api.aws",
        "http://ianswertomom.com/develop-wise-woman-within-yourself",
        "firebase-auth-eich0v.pages.dev",
        "https://clear.ml/infrastructure-control-plane",
        "howtoworkacrickoutofyourneck2.pages.dev",
        "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
        "Attacks are being carried out by The State of Colorado",
        "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
        "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
        "https://khmerpornvideo.signup0.y.id/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Nids",
            "#lowfi:hstr:criakl.b1",
            "Cve-2017-11882",
            "Trojandownloader:win32/cutwail",
            "Backdoor:win32/arwobot.b",
            "Ddos:linux/gafgyt.ya!mtb",
            "Backdoor:linux/demonbot.aa!mtb",
            "Unix.trojan.gafgyt-6981154-0",
            "Unix.trojan.tsunami-6981155-0",
            "Worm",
            "Trojandownloader:win32/cutwailransom:win32/crowti.a",
            "Win.downloader.small-4507",
            "Trojan:win32/qbot.r!mtb",
            "Win.packed.bandook-9882274-1",
            "Ransom:win32/crowti.a",
            "Mirai (elf)",
            "Alf:heraklezeval:trojan:msil/gravityrat!rfn",
            "Cycbot",
            "Trojandropper:win32/systex.a",
            "Win32:botx-gen\\ [trj]",
            "Alf:nid:susp_nsis_stub.a",
            "Win.malware.mikey-9949492-0",
            "Win.trojan.gravityrat-6511862-0",
            "Alf:exploit:o97m/cve-2017-8977",
            "Win.trojan.tepfer-61",
            "Virtool:win32/vbinject.gen!mh"
          ],
          "industries": [
            "Insurance",
            "Construction"
          ],
          "unique_indicators": 114040
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/awsdns-62.com",
    "whois": "http://whois.domaintools.com/awsdns-62.com",
    "domain": "awsdns-62.com",
    "hostname": "ns-497.awsdns-62.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "693cdc5b8ebc10664439c2fb",
      "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - Freeman Mathis & Gary for The State of Colorado",
      "description": "State of Colorado attackers use  DGA domains set up multiple Law Firms.. Christopher P.  \u2019Buzz\u2019  Ahmann  Is a legal consultant / attorney./ hacker \nWorks for the State of Colorado/ quasi. Is malicious and doesn\u2019t work alone. Continues to target \nState had relative contacted by a fake entity \u2018Goodness Health\u2019\nLeft vague VM for relative message \u201cWe work on the Medicare side of things.\u201d and? \nSocial engineering call , malicious domain. The State of Colorado has been on a relentless pursuit against target. Fully compromised targets relatives brand new phone. Hacked target since 10/2013.\nMultiple cyber and physical attacks carried out  against target and family members.. There are attacks make  to look like accidents or malfunctions. This harmful, silencing behavior is somehow illegal for anyone else.",
      "modified": "2026-02-10T06:05:39.764000",
      "created": "2025-12-13T03:24:11.414000",
      "tags": [
        "colorado state",
        "freeman mathis",
        "history",
        "cyber risk",
        "aspen insureds",
        "gaig insureds",
        "landy insureds",
        "nip group",
        "purm insureds",
        "overview core",
        "united",
        "ip address",
        "present nov",
        "present may",
        "moved",
        "encrypt",
        "unknown",
        "backdoor",
        "passive dns",
        "ransom",
        "checkin",
        "trojandropper",
        "mtb nov",
        "twitter",
        "trojan",
        "data upload",
        "extraction",
        "failed",
        "united states",
        "server response",
        "google safe",
        "results may",
        "lowfi",
        "virtool",
        "mtb alf",
        "mh alf",
        "port",
        "windows nt",
        "destination",
        "msie",
        "khtml",
        "gecko",
        "unknown aaaa",
        "a domains",
        "meta",
        "for privacy",
        "cop supply",
        "urls",
        "as139646 hong",
        "hostname",
        "files",
        "hong kong",
        "domain add",
        "ip related",
        "hash avast",
        "avg clamav",
        "msdefender may",
        "ddos",
        "as13335",
        "ipv4",
        "certificate",
        "hostname add",
        "url analysis",
        "files ip",
        "name strings",
        "category",
        "united states",
        "pulse indicator",
        "address",
        "error",
        "null",
        "object",
        "string",
        "number",
        "google maps",
        "promise",
        "javascript api",
        "dataset",
        "bigint",
        "dark",
        "android",
        "infinity",
        "internal",
        "roboto",
        "trident",
        "void",
        "small",
        "lightrail",
        "false",
        "span",
        "close",
        "light",
        "hybrid",
        "embed",
        "iframe",
        "keygen",
        "this",
        "february",
        "bounce",
        "drop",
        "inside",
        "outside",
        "marker",
        "present dec",
        "pulses otx",
        "aaaa",
        "asnone country",
        "record value",
        "title",
        "pulse pulses",
        "pulses",
        "showing",
        "unknown cname",
        "unknown soa",
        "next associated",
        "ipv4 add",
        "cycbot",
        "extract indic",
        "sneaker bots",
        "proxies data",
        "script script",
        "adult content",
        "nextimage",
        "porn site",
        "div div",
        "platform make",
        "cloudfront x",
        "hio52 p3",
        "unknown ns",
        "pulse submit",
        "title error",
        "reverse dns",
        "status",
        "servers",
        "name servers",
        "vashti hostname",
        "scan endpoints",
        "url http",
        "http",
        "files domain",
        "files related",
        "pulses none",
        "dnssec",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "version list",
        "domain",
        "emails",
        "cookie",
        "url https",
        "show",
        "filehash",
        "urls show",
        "date checked",
        "url hostname",
        "results nov",
        "win32",
        "type",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "defense evasion",
        "spawns",
        "flag",
        "llc name",
        "server",
        "markmonitor",
        "name server",
        "windir",
        "openurl c",
        "prefetch2",
        "show technique",
        "mitre att",
        "ck matrix",
        "pattern match",
        "ascii text",
        "sha1",
        "href",
        "show process",
        "file",
        "general",
        "local",
        "path",
        "germany unknown",
        "date",
        "registrar",
        "ip whois",
        "dynamicloader",
        "high",
        "medium",
        "search",
        "displayname",
        "tofsee",
        "win64",
        "write",
        "stream",
        "malware",
        "push",
        "entries",
        "tls handshake",
        "failure",
        "forbidden",
        "tlsv1",
        "april",
        "next",
        "write c",
        "intel",
        "ms windows",
        "sha1 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "sha256 add",
        "present jun",
        "present mar",
        "medelln",
        "colombia asn",
        "dns resolutions",
        "address domain",
        "related tags",
        "none google",
        "safe browsing",
        "external",
        "present sep",
        "present aug",
        "as54113",
        "present jul",
        "as8068",
        "gmt content",
        "total",
        "read",
        "delete",
        "top source",
        "quasi",
        "murderers",
        "christopher ahmann",
        "buzz ahmann",
        "wow64",
        "slcc2",
        "media center",
        "labor",
        "employment",
        "cdle",
        "dowc",
        "colorado",
        "workers",
        "coloradoif",
        "independent",
        "state",
        "company",
        "entity type",
        "authorized line",
        "analysis",
        "tor analysis",
        "process details",
        "network traffic",
        "t1071",
        "potential ip",
        "click",
        "found",
        "t1480 execution",
        "bad traffic",
        "et info",
        "ck techniques",
        "evasion att",
        "t1057",
        "refresh",
        "body",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "cname",
        "form",
        "pulse",
        "script domains",
        "script urls",
        "administrator",
        "services llc",
        "dns admin",
        "domain admin",
        "global llc",
        "domain manager",
        "computer system",
        "ltd domain",
        "network",
        "alibaba",
        "facebook",
        "phishme",
        "sogou",
        "present jan",
        "present feb",
        "present oct"
      ],
      "references": [
        "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
        "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
        "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
        "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
        "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
        "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
        "https://maps.googleapis.com/maps/api/js?sensor=false",
        "cell-0.af-south-1.prod.telemetry.console.api.aws",
        "howtoworkacrickoutofyourneck2.pages.dev",
        "firebase-auth-eich0v.pages.dev",
        "http://ianswertomom.com/develop-wise-woman-within-yourself",
        "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
        "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
        "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
        "https://khmerpornvideo.signup0.y.id/",
        "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
        "https://clear.ml/infrastructure-control-plane",
        "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
        "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
        "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
        "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
        "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
        "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
        "Legal court documented  agreement to allow and pay target to hire cyber investigators",
        "Attacks are being carried out by The State of Colorado"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan",
        "France",
        "Ireland",
        "Spain",
        "Italy",
        "Aruba",
        "Australia",
        "Denmark",
        "United Kingdom of Great Britain and Northern Ireland",
        "Germany",
        "T\u00fcrkiye",
        "Indonesia"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.GravityRAT-6511862-0",
          "display_name": "Win.Trojan.GravityRAT-6511862-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Unix.Trojan.Tsunami-6981155-0",
          "display_name": "Unix.Trojan.Tsunami-6981155-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Systex.A",
          "display_name": "TrojanDropper:Win32/Systex.A",
          "target": "/malware/TrojanDropper:Win32/Systex.A"
        },
        {
          "id": "Win.Trojan.Tepfer-61",
          "display_name": "Win.Trojan.Tepfer-61",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "target": null
        },
        {
          "id": "VirTool:Win32/VBInject.gen!MH",
          "display_name": "VirTool:Win32/VBInject.gen!MH",
          "target": "/malware/VirTool:Win32/VBInject.gen!MH"
        },
        {
          "id": "ALF:NID:Susp_NSIS_Stub.A",
          "display_name": "ALF:NID:Susp_NSIS_Stub.A",
          "target": null
        },
        {
          "id": "#LOWFI:HSTR:Criakl.B1",
          "display_name": "#LOWFI:HSTR:Criakl.B1",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Arwobot.B",
          "display_name": "Backdoor:Win32/Arwobot.B",
          "target": "/malware/Backdoor:Win32/Arwobot.B"
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        },
        {
          "id": "Win.Downloader.Small-4507",
          "display_name": "Win.Downloader.Small-4507",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qbot.R!MTB",
          "display_name": "Trojan:Win32/Qbot.R!MTB",
          "target": "/malware/Trojan:Win32/Qbot.R!MTB"
        },
        {
          "id": "Win.Malware.Mikey-9949492-0",
          "display_name": "Win.Malware.Mikey-9949492-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti.A",
          "display_name": "Ransom:Win32/Crowti.A",
          "target": "/malware/Ransom:Win32/Crowti.A"
        },
        {
          "id": "Backdoor:Linux/DemonBot.Aa!MTB",
          "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
          "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
        },
        {
          "id": "Unix.Trojan.Gafgyt-6981154-0",
          "display_name": "Unix.Trojan.Gafgyt-6981154-0",
          "target": null
        },
        {
          "id": "DDOS:Linux/Gafgyt.YA!MTB",
          "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
          "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
        },
        {
          "id": "CVE-2017-11882",
          "display_name": "CVE-2017-11882",
          "target": null
        },
        {
          "id": "ALF:Exploit:O97M/CVE-2017-8977",
          "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
          "target": null
        },
        {
          "id": "Cycbot",
          "display_name": "Cycbot",
          "target": null
        },
        {
          "id": "Win32:BotX-gen\\ [Trj]",
          "display_name": "Win32:BotX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "NIDS",
          "display_name": "NIDS",
          "target": null
        },
        {
          "id": "Mirai (ELF)",
          "display_name": "Mirai (ELF)",
          "target": null
        },
        {
          "id": "Worm",
          "display_name": "Worm",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        }
      ],
      "industries": [
        "Insurance",
        "Construction"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 54118,
        "domain": 11153,
        "hostname": 18578,
        "email": 21,
        "FileHash-SHA256": 4905,
        "FileHash-MD5": 548,
        "FileHash-SHA1": 534,
        "CVE": 7,
        "SSLCertFingerprint": 20,
        "CIDR": 1
      },
      "indicator_count": 89885,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "69 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6963596c4cd594b77b4675ec",
      "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - PalantirFoundry | The State of Colorado | ",
      "description": "",
      "modified": "2026-02-10T06:05:39.764000",
      "created": "2026-01-11T08:03:56.534000",
      "tags": [
        "colorado state",
        "freeman mathis",
        "history",
        "cyber risk",
        "aspen insureds",
        "gaig insureds",
        "landy insureds",
        "nip group",
        "purm insureds",
        "overview core",
        "united",
        "ip address",
        "present nov",
        "present may",
        "moved",
        "encrypt",
        "unknown",
        "backdoor",
        "passive dns",
        "ransom",
        "checkin",
        "trojandropper",
        "mtb nov",
        "twitter",
        "trojan",
        "data upload",
        "extraction",
        "failed",
        "united states",
        "server response",
        "google safe",
        "results may",
        "lowfi",
        "virtool",
        "mtb alf",
        "mh alf",
        "port",
        "windows nt",
        "destination",
        "msie",
        "khtml",
        "gecko",
        "unknown aaaa",
        "a domains",
        "meta",
        "for privacy",
        "cop supply",
        "urls",
        "as139646 hong",
        "hostname",
        "files",
        "hong kong",
        "domain add",
        "ip related",
        "hash avast",
        "avg clamav",
        "msdefender may",
        "ddos",
        "as13335",
        "ipv4",
        "certificate",
        "hostname add",
        "url analysis",
        "files ip",
        "name strings",
        "category",
        "united states",
        "pulse indicator",
        "address",
        "error",
        "null",
        "object",
        "string",
        "number",
        "google maps",
        "promise",
        "javascript api",
        "dataset",
        "bigint",
        "dark",
        "android",
        "infinity",
        "internal",
        "roboto",
        "trident",
        "void",
        "small",
        "lightrail",
        "false",
        "span",
        "close",
        "light",
        "hybrid",
        "embed",
        "iframe",
        "keygen",
        "this",
        "february",
        "bounce",
        "drop",
        "inside",
        "outside",
        "marker",
        "present dec",
        "pulses otx",
        "aaaa",
        "asnone country",
        "record value",
        "title",
        "pulse pulses",
        "pulses",
        "showing",
        "unknown cname",
        "unknown soa",
        "next associated",
        "ipv4 add",
        "cycbot",
        "extract indic",
        "sneaker bots",
        "proxies data",
        "script script",
        "adult content",
        "nextimage",
        "porn site",
        "div div",
        "platform make",
        "cloudfront x",
        "hio52 p3",
        "unknown ns",
        "pulse submit",
        "title error",
        "reverse dns",
        "status",
        "servers",
        "name servers",
        "vashti hostname",
        "scan endpoints",
        "url http",
        "http",
        "files domain",
        "files related",
        "pulses none",
        "dnssec",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "version list",
        "domain",
        "emails",
        "cookie",
        "url https",
        "show",
        "filehash",
        "urls show",
        "date checked",
        "url hostname",
        "results nov",
        "win32",
        "type",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "defense evasion",
        "spawns",
        "flag",
        "llc name",
        "server",
        "markmonitor",
        "name server",
        "windir",
        "openurl c",
        "prefetch2",
        "show technique",
        "mitre att",
        "ck matrix",
        "pattern match",
        "ascii text",
        "sha1",
        "href",
        "show process",
        "file",
        "general",
        "local",
        "path",
        "germany unknown",
        "date",
        "registrar",
        "ip whois",
        "dynamicloader",
        "high",
        "medium",
        "search",
        "displayname",
        "tofsee",
        "win64",
        "write",
        "stream",
        "malware",
        "push",
        "entries",
        "tls handshake",
        "failure",
        "forbidden",
        "tlsv1",
        "april",
        "next",
        "write c",
        "intel",
        "ms windows",
        "sha1 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "sha256 add",
        "present jun",
        "present mar",
        "medelln",
        "colombia asn",
        "dns resolutions",
        "address domain",
        "related tags",
        "none google",
        "safe browsing",
        "external",
        "present sep",
        "present aug",
        "as54113",
        "present jul",
        "as8068",
        "gmt content",
        "total",
        "read",
        "delete",
        "top source",
        "quasi",
        "murderers",
        "christopher ahmann",
        "buzz ahmann",
        "wow64",
        "slcc2",
        "media center",
        "labor",
        "employment",
        "cdle",
        "dowc",
        "colorado",
        "workers",
        "coloradoif",
        "independent",
        "state",
        "company",
        "entity type",
        "authorized line",
        "analysis",
        "tor analysis",
        "process details",
        "network traffic",
        "t1071",
        "potential ip",
        "click",
        "found",
        "t1480 execution",
        "bad traffic",
        "et info",
        "ck techniques",
        "evasion att",
        "t1057",
        "refresh",
        "body",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "cname",
        "form",
        "pulse",
        "script domains",
        "script urls",
        "administrator",
        "services llc",
        "dns admin",
        "domain admin",
        "global llc",
        "domain manager",
        "computer system",
        "ltd domain",
        "network",
        "alibaba",
        "facebook",
        "phishme",
        "sogou",
        "present jan",
        "present feb",
        "present oct"
      ],
      "references": [
        "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
        "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
        "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
        "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
        "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
        "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
        "https://maps.googleapis.com/maps/api/js?sensor=false",
        "cell-0.af-south-1.prod.telemetry.console.api.aws",
        "howtoworkacrickoutofyourneck2.pages.dev",
        "firebase-auth-eich0v.pages.dev",
        "http://ianswertomom.com/develop-wise-woman-within-yourself",
        "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
        "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
        "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
        "https://khmerpornvideo.signup0.y.id/",
        "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
        "https://clear.ml/infrastructure-control-plane",
        "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
        "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
        "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
        "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
        "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
        "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
        "Legal court documented  agreement to allow and pay target to hire cyber investigators",
        "Attacks are being carried out by The State of Colorado"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan",
        "France",
        "Ireland",
        "Spain",
        "Italy",
        "Aruba",
        "Australia",
        "Denmark",
        "United Kingdom of Great Britain and Northern Ireland",
        "Germany",
        "T\u00fcrkiye",
        "Indonesia"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.GravityRAT-6511862-0",
          "display_name": "Win.Trojan.GravityRAT-6511862-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Unix.Trojan.Tsunami-6981155-0",
          "display_name": "Unix.Trojan.Tsunami-6981155-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Systex.A",
          "display_name": "TrojanDropper:Win32/Systex.A",
          "target": "/malware/TrojanDropper:Win32/Systex.A"
        },
        {
          "id": "Win.Trojan.Tepfer-61",
          "display_name": "Win.Trojan.Tepfer-61",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "target": null
        },
        {
          "id": "VirTool:Win32/VBInject.gen!MH",
          "display_name": "VirTool:Win32/VBInject.gen!MH",
          "target": "/malware/VirTool:Win32/VBInject.gen!MH"
        },
        {
          "id": "ALF:NID:Susp_NSIS_Stub.A",
          "display_name": "ALF:NID:Susp_NSIS_Stub.A",
          "target": null
        },
        {
          "id": "#LOWFI:HSTR:Criakl.B1",
          "display_name": "#LOWFI:HSTR:Criakl.B1",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Arwobot.B",
          "display_name": "Backdoor:Win32/Arwobot.B",
          "target": "/malware/Backdoor:Win32/Arwobot.B"
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        },
        {
          "id": "Win.Downloader.Small-4507",
          "display_name": "Win.Downloader.Small-4507",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qbot.R!MTB",
          "display_name": "Trojan:Win32/Qbot.R!MTB",
          "target": "/malware/Trojan:Win32/Qbot.R!MTB"
        },
        {
          "id": "Win.Malware.Mikey-9949492-0",
          "display_name": "Win.Malware.Mikey-9949492-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti.A",
          "display_name": "Ransom:Win32/Crowti.A",
          "target": "/malware/Ransom:Win32/Crowti.A"
        },
        {
          "id": "Backdoor:Linux/DemonBot.Aa!MTB",
          "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
          "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
        },
        {
          "id": "Unix.Trojan.Gafgyt-6981154-0",
          "display_name": "Unix.Trojan.Gafgyt-6981154-0",
          "target": null
        },
        {
          "id": "DDOS:Linux/Gafgyt.YA!MTB",
          "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
          "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
        },
        {
          "id": "CVE-2017-11882",
          "display_name": "CVE-2017-11882",
          "target": null
        },
        {
          "id": "ALF:Exploit:O97M/CVE-2017-8977",
          "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
          "target": null
        },
        {
          "id": "Cycbot",
          "display_name": "Cycbot",
          "target": null
        },
        {
          "id": "Win32:BotX-gen\\ [Trj]",
          "display_name": "Win32:BotX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "NIDS",
          "display_name": "NIDS",
          "target": null
        },
        {
          "id": "Mirai (ELF)",
          "display_name": "Mirai (ELF)",
          "target": null
        },
        {
          "id": "Worm",
          "display_name": "Worm",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        }
      ],
      "industries": [
        "Insurance",
        "Construction"
      ],
      "TLP": "green",
      "cloned_from": "693cdc5b8ebc10664439c2fb",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 54118,
        "domain": 11153,
        "hostname": 18578,
        "email": 21,
        "FileHash-SHA256": 4905,
        "FileHash-MD5": 548,
        "FileHash-SHA1": 534,
        "CVE": 7,
        "SSLCertFingerprint": 20,
        "CIDR": 1
      },
      "indicator_count": 89885,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "69 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6894f30905efa56990bb10f6",
      "name": "Expanded device-local-****remotewd.com",
      "description": "device-local-2ffdbd74-9f90-41fa-beb8-454ed65788c5.remotewd.com",
      "modified": "2025-09-06T06:03:31.462000",
      "created": "2025-08-07T18:40:09.876000",
      "tags": [
        "hostname",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "nameservers",
        "date hash",
        "avast avg",
        "entries",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "itre att",
        "ck techniques",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "domain",
        "hostname add",
        "files ip",
        "address",
        "location united",
        "hash avast",
        "avg clamav",
        "msdefender aug",
        "united",
        "port",
        "destination",
        "as16509",
        "search",
        "unknown",
        "ocloudflare",
        "medium",
        "memcommit",
        "service",
        "write",
        "next",
        "persistence",
        "execution",
        "malware",
        "copy",
        "encrypt",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "next associated",
        "urls show",
        "date checked",
        "virtool",
        "win64",
        "worm",
        "mtb may",
        "files show",
        "heur",
        "script",
        "dropper",
        "ransom",
        "vitro",
        "pe32",
        "intel",
        "ms windows",
        "as15169",
        "read c",
        "asnone",
        "show",
        "packing t1045",
        "t1045",
        "delphi",
        "code",
        "june"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6741,
        "domain": 5822,
        "FileHash-SHA256": 1550,
        "URL": 16348,
        "FileHash-MD5": 287,
        "FileHash-SHA1": 242,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 31000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6894f4e6c41982f405592b55",
      "name": "Worm:Win32/Mydoom | Expanded device-local-****remotewd.com",
      "description": "",
      "modified": "2025-09-06T06:03:31.462000",
      "created": "2025-08-07T18:48:06.557000",
      "tags": [
        "hostname",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "nameservers",
        "date hash",
        "avast avg",
        "entries",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "itre att",
        "ck techniques",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "domain",
        "hostname add",
        "files ip",
        "address",
        "location united",
        "hash avast",
        "avg clamav",
        "msdefender aug",
        "united",
        "port",
        "destination",
        "as16509",
        "search",
        "unknown",
        "ocloudflare",
        "medium",
        "memcommit",
        "service",
        "write",
        "next",
        "persistence",
        "execution",
        "malware",
        "copy",
        "encrypt",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "next associated",
        "urls show",
        "date checked",
        "virtool",
        "win64",
        "worm",
        "mtb may",
        "files show",
        "heur",
        "script",
        "dropper",
        "ransom",
        "vitro",
        "pe32",
        "intel",
        "ms windows",
        "as15169",
        "read c",
        "asnone",
        "show",
        "packing t1045",
        "t1045",
        "delphi",
        "code",
        "june"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6894f30905efa56990bb10f6",
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6741,
        "domain": 5822,
        "FileHash-SHA256": 1550,
        "URL": 16348,
        "FileHash-MD5": 287,
        "FileHash-SHA1": 242,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 31000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68923ea4efbf58b7ba48acec",
      "name": "Hosted App",
      "description": "",
      "modified": "2025-09-04T16:03:17.037000",
      "created": "2025-08-05T17:25:56.454000",
      "tags": [
        "issuer wr3",
        "log id",
        "gmtn",
        "abn timestamp",
        "ad180b80",
        "full name",
        "extensionsstr",
        "web server",
        "ca issuers",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "mitre att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "ascii text",
        "pattern match",
        "show technique",
        "date",
        "format",
        "august",
        "hybrid",
        "local",
        "path",
        "click",
        "strings",
        "flag",
        "usa windows",
        "hwp support",
        "march",
        "december",
        "united",
        "markmonitor",
        "overview dns",
        "requests domain",
        "country",
        "contacted hosts",
        "ip address",
        "process details",
        "t1179 hooking",
        "access windows",
        "installs",
        "control att",
        "found",
        "development att",
        "name server",
        "show process",
        "programfiles",
        "command decode",
        "suricata ipv4",
        "ck matrix",
        "comspec",
        "model",
        "general",
        "dynamicloader",
        "unknown",
        "as16509",
        "whitelisted",
        "medium",
        "write c",
        "as15169",
        "search",
        "high",
        "write",
        "android",
        "malware",
        "copy",
        "next",
        "formbook cnc",
        "checkin",
        "entries",
        "passive dns",
        "next associated",
        "site",
        "neue",
        "ipv4",
        "pulse pulses",
        "exploit",
        "trojan",
        "virtool",
        "body",
        "refer",
        "present dec",
        "epub",
        "present jan",
        "present nov",
        "present oct",
        "showing",
        "urls show",
        "win32",
        "win64",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "prefetch8",
        "localappdata",
        "prefetch1"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3409,
        "hostname": 4127,
        "URL": 8408,
        "SSLCertFingerprint": 9,
        "FileHash-SHA256": 1175,
        "FileHash-MD5": 144,
        "FileHash-SHA1": 134,
        "CVE": 2
      },
      "indicator_count": 17408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "228 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687c07591d641de3c896d4a9",
      "name": "icon.palantirfoundry.com - Brazzers Porn",
      "description": "Another strange pulse. Persistent bad actors moved and changed name of operation; of course. Usual - Hostname\nicon.palantirfoundry.com , Apple, Samsung , X.com , Twitter , Facebook, Google, Palantir NSA or a poser? I was threatened this week, I was told that if I was on the \u2018list\u2019 they have to do anything that is asked including \u2018blow me up\u2019. Sounds nuts but I can\u2019t believe this. Whoever has been doing this is hyper dangerous.\n\nicon.palantirfoundry.com ?  P.S. Huge pulse. Can\u2019t use private option to cherry pick the IoC\u2019s I\u2019d like to breakdown. Have I broken a rule?",
      "modified": "2025-08-18T18:01:11.130000",
      "created": "2025-07-19T21:00:09.343000",
      "tags": [
        "canada unknown",
        "passive dns",
        "ransom",
        "entries",
        "ipv4",
        "pulse submit",
        "url analysis",
        "urls",
        "files",
        "reverse dns",
        "united",
        "unknown ns",
        "moved",
        "ip address",
        "creation date",
        "search",
        "omain",
        "pulse pulses",
        "body",
        "date",
        "showing",
        "domain",
        "hostname",
        "ocloudflare",
        "stca",
        "lsan francisco",
        "ecc ca3",
        "ecc ca2",
        "as16509",
        "unknown",
        "ms windows",
        "encrypt",
        "write",
        "next",
        "service",
        "malware",
        "copy",
        "unknown soa",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "present jan",
        "medium",
        "memcommit",
        "module load",
        "t1129",
        "regopenkeyexw",
        "fjlsedauv",
        "et useragents",
        "go http",
        "registry run",
        "persistence",
        "execution",
        "checks",
        "keys",
        "start folder",
        "richhash",
        "external",
        "virustotal api",
        "screenshots",
        "find",
        "show",
        "types",
        "seard type",
        "indicator",
        "data upload",
        "extraction",
        "failed",
        "sc data",
        "type",
        "extri included",
        "review data",
        "sugges data",
        "find suxxesteu",
        "typ indicalon"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 62,
        "FileHash-SHA1": 17,
        "FileHash-SHA256": 1433,
        "URL": 10188,
        "hostname": 5658,
        "domain": 5753,
        "email": 4,
        "SSLCertFingerprint": 20
      },
      "indicator_count": 23135,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "245 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ns-497.awsdns-62.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ns-497.awsdns-62.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776713179.8428974
}