{
  "type": "URL",
  "indicator": "https://ns1.player1352.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ns1.player1352.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3661719854,
      "indicator": "https://ns1.player1352.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "68beb866c8ed898ed0ece438",
          "name": "BlackieVirus . Expanded- Apple",
          "description": "",
          "modified": "2025-10-08T10:00:30.227000",
          "created": "2025-09-08T11:05:10.064000",
          "tags": [
            "present may",
            "present apr",
            "unknown ns",
            "present sep",
            "unknown aaaa",
            "present jun",
            "present dec",
            "passive dns",
            "ip address",
            "virtool",
            "win32cve sep",
            "trojan",
            "mtb sep",
            "ipv4",
            "urls",
            "trojanspy",
            "united states",
            "dynamicloader",
            "ms windows",
            "observed dns",
            "query",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "pe32",
            "write",
            "media",
            "malware",
            "suspicious",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "command",
            "defense evasion",
            "adversaries",
            "spawns",
            "t1204 user",
            "mitre att",
            "ck matrix",
            "null",
            "error",
            "click",
            "general",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "meta",
            "onload",
            "span",
            "apple",
            "entries",
            "write c",
            "defender",
            "tencent",
            "hostname add",
            "pulse submit",
            "url analysis",
            "present jul",
            "present mar",
            "present oct",
            "saudi arabia",
            "united",
            "present feb",
            "creation date",
            "search",
            "title",
            "date",
            "botnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            },
            {
              "id": "Win.Trojan.Filerepmalware-10008115-0",
              "display_name": "Win.Trojan.Filerepmalware-10008115-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 951,
            "hostname": 1766,
            "URL": 4969,
            "FileHash-MD5": 337,
            "FileHash-SHA1": 317,
            "FileHash-SHA256": 4296,
            "CVE": 1,
            "SSLCertFingerprint": 1,
            "email": 1
          },
          "indicator_count": 12639,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "193 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "674ea53a3509f6554438cfb6",
          "name": "extrapolation from some ips in 2023 report",
          "description": "",
          "modified": "2025-06-02T19:58:17.107000",
          "created": "2024-12-03T06:29:14.674000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1131,
            "hostname": 2551,
            "domain": 1669,
            "URL": 6806,
            "CVE": 1
          },
          "indicator_count": 12158,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 184,
          "modified_text": "320 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66246ff49ed29ea9bb2bf122",
          "name": "S\u0105d Rejonowy w Jeleniej Gorze  POLAND",
          "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations",
          "modified": "2025-05-14T21:18:36.989000",
          "created": "2024-04-21T01:46:28.554000",
          "tags": [
            "jeleniej grze",
            "aktualnoci",
            "informacje",
            "jednostka",
            "rejonowy",
            "konkurs",
            "najczciej",
            "sd rejonowy",
            "przejd",
            "czytaj",
            "click",
            "sdzia jarosaw",
            "wydziau",
            "sdzia grzegorz",
            "katarzyna",
            "rudnicka dane",
            "kontaktowe sd",
            "jelenia gra",
            "mickiewicza",
            "zawarto",
            "html",
            "nazwa meta",
            "robotw",
            "telefon",
            "brak",
            "skala",
            "ua zgodna",
            "head body",
            "zasb",
            "cname",
            "kod odpowiedzi",
            "kodowanie treci",
            "wygasa",
            "gmt serwer",
            "pragma",
            "kontrola pamici",
            "podrcznej",
            "data",
            "gmt kontrola",
            "dostpuzezwl na",
            "czytaj wicej",
            "sd okrgowy",
            "jednostki",
            "okrgowy",
            "ogoszenia",
            "sha256",
            "vhash",
            "ssdeep",
            "https odcisk",
            "palca jarma",
            "https dane",
            "v3 numer",
            "odcisk palca",
            "tworzy katalog",
            "tworzy pliki",
            "typ pliku",
            "json",
            "ascii",
            "windows",
            "sqlite",
            "foxpro fpt",
            "links typ",
            "mapa",
            "152 x",
            "sqlite w",
            "sha1",
            "sha512",
            "file size",
            "b file",
            "testing",
            "komornik sdowy",
            "sdzie rejonowym",
            "tomasz rodacki",
            "obwieszczenie",
            "komornicze",
            "tumacza migam",
            "tumacz czynny",
            "zamknite",
            "wiadczenia",
            "schedule",
            "error",
            "javascript",
            "bakers hall",
            "ixaction",
            "script",
            "ixchatlauncher",
            "compatibility",
            "com dla",
            "t1055 pewno",
            "unikanie obrony",
            "t1036 maskarada",
            "t1082 pewno",
            "informacje o",
            "nazwa pliku",
            "dokument pdf",
            "rozmiar pliku",
            "zapowied",
            "type",
            "iii dbt",
            "utf8",
            "dziennik"
          ],
          "references": [
            "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
            "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
            "http://www.jelenia-gora.so.gov.pl/",
            "https://www.jelenia-gora.so.gov.pl/",
            "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
            "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
            "https://www.jelenia-gora.sr.gov.pl/spacer",
            "https://waf.intelix.pl/957476/Chat/Script/Compatibility"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "",
              "display_name": "",
              "target": null
            },
            {
              "id": "serwer",
              "display_name": "serwer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 71,
            "domain": 7651,
            "hostname": 7680,
            "IPv4": 331,
            "FileHash-SHA256": 16168,
            "URL": 10399,
            "FileHash-MD5": 3639,
            "FileHash-SHA1": 3468,
            "CIDR": 4,
            "CVE": 89,
            "YARA": 521,
            "SSLCertFingerprint": 25,
            "JA3": 1,
            "IPv6": 5813
          },
          "indicator_count": 55860,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb4768b06f4da2fba5959b",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:44.270000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "766 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb476d0566c2d07e474df5",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:49.140000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "766 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb476d935dd560b4a3e938",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:49.380000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "766 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb4772c3d3ad1f7accc98a",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:53.179000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "766 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657099644208c92832a9ae92",
          "name": "those ip's JL v2 all suggested ioc's - Data you got \ud83d\ude1c\ud83e\udd37\u200d\u2640\ufe0f",
          "description": "",
          "modified": "2023-12-06T15:55:15.497000",
          "created": "2023-12-06T15:55:15.497000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 4582,
            "FileHash-SHA256": 2374,
            "CVE": 5,
            "domain": 3456,
            "URL": 14212,
            "FileHash-MD5": 13,
            "FileHash-SHA1": 13
          },
          "indicator_count": 24655,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "643746d7f4010b92e37ace06",
          "name": "those ip's JL v2 all suggested ioc's - Data you got \ud83d\ude1c\ud83e\udd37\u200d\u2640\ufe0f",
          "description": "",
          "modified": "2023-04-13T00:03:35.384000",
          "created": "2023-04-13T00:03:35.384000",
          "tags": [],
          "references": [
            "g4991d86fdf3941e589ac92d5848b9f8d260d7afe5e9f47839d69fe03b34b062e.json"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 89,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14212,
            "FileHash-SHA256": 2374,
            "hostname": 4582,
            "domain": 3456,
            "CVE": 5,
            "IPv4": 311,
            "FileHash-MD5": 13,
            "FileHash-SHA1": 13
          },
          "indicator_count": 24966,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 94,
          "modified_text": "1102 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "sex-ukraine.net",
        "CVE: CVE-2023-23397",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html",
        "ddos.dnsnb8.net [command_and_control]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
        "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "http://www.jelenia-gora.so.gov.pl/",
        "g4991d86fdf3941e589ac92d5848b9f8d260d7afe5e9f47839d69fe03b34b062e.json",
        "https://www.jelenia-gora.sr.gov.pl/spacer",
        "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
        "https://waf.intelix.pl/957476/Chat/Script/Compatibility",
        "www.supernetforme.com  [command_and_control]",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "https://www.jelenia-gora.so.gov.pl/",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "workers.dev [extraction \u2022 GET request attack]",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "nexus.b2btest.ertelecom.ru",
        "https://twitter.com/PORNO_SEXYBABES"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "",
            "Emotet",
            "Lolkek",
            "Hacktool",
            "Ransomexx",
            "Sabey",
            "Lockbit",
            "Ryuk ransomware",
            "#virtool:win32/obfuscator.adb",
            "Makop",
            "Hallgrand",
            "Qakbot",
            "Hallrender",
            "Malware",
            "Alf:heraklezeval:ransom:win32/cve",
            "Win.trojan.filerepmalware-10008115-0",
            "Serwer",
            "Ursnif"
          ],
          "industries": [],
          "unique_indicators": 114968
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/player1352.net",
    "whois": "http://whois.domaintools.com/player1352.net",
    "domain": "player1352.net",
    "hostname": "ns1.player1352.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "68beb866c8ed898ed0ece438",
      "name": "BlackieVirus . Expanded- Apple",
      "description": "",
      "modified": "2025-10-08T10:00:30.227000",
      "created": "2025-09-08T11:05:10.064000",
      "tags": [
        "present may",
        "present apr",
        "unknown ns",
        "present sep",
        "unknown aaaa",
        "present jun",
        "present dec",
        "passive dns",
        "ip address",
        "virtool",
        "win32cve sep",
        "trojan",
        "mtb sep",
        "ipv4",
        "urls",
        "trojanspy",
        "united states",
        "dynamicloader",
        "ms windows",
        "observed dns",
        "query",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "pe32",
        "write",
        "media",
        "malware",
        "suspicious",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "command",
        "defense evasion",
        "adversaries",
        "spawns",
        "t1204 user",
        "mitre att",
        "ck matrix",
        "null",
        "error",
        "click",
        "general",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "meta",
        "onload",
        "span",
        "apple",
        "entries",
        "write c",
        "defender",
        "tencent",
        "hostname add",
        "pulse submit",
        "url analysis",
        "present jul",
        "present mar",
        "present oct",
        "saudi arabia",
        "united",
        "present feb",
        "creation date",
        "search",
        "title",
        "date",
        "botnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        },
        {
          "id": "Win.Trojan.Filerepmalware-10008115-0",
          "display_name": "Win.Trojan.Filerepmalware-10008115-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 951,
        "hostname": 1766,
        "URL": 4969,
        "FileHash-MD5": 337,
        "FileHash-SHA1": 317,
        "FileHash-SHA256": 4296,
        "CVE": 1,
        "SSLCertFingerprint": 1,
        "email": 1
      },
      "indicator_count": 12639,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "193 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "674ea53a3509f6554438cfb6",
      "name": "extrapolation from some ips in 2023 report",
      "description": "",
      "modified": "2025-06-02T19:58:17.107000",
      "created": "2024-12-03T06:29:14.674000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1131,
        "hostname": 2551,
        "domain": 1669,
        "URL": 6806,
        "CVE": 1
      },
      "indicator_count": 12158,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 184,
      "modified_text": "320 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66246ff49ed29ea9bb2bf122",
      "name": "S\u0105d Rejonowy w Jeleniej Gorze  POLAND",
      "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations",
      "modified": "2025-05-14T21:18:36.989000",
      "created": "2024-04-21T01:46:28.554000",
      "tags": [
        "jeleniej grze",
        "aktualnoci",
        "informacje",
        "jednostka",
        "rejonowy",
        "konkurs",
        "najczciej",
        "sd rejonowy",
        "przejd",
        "czytaj",
        "click",
        "sdzia jarosaw",
        "wydziau",
        "sdzia grzegorz",
        "katarzyna",
        "rudnicka dane",
        "kontaktowe sd",
        "jelenia gra",
        "mickiewicza",
        "zawarto",
        "html",
        "nazwa meta",
        "robotw",
        "telefon",
        "brak",
        "skala",
        "ua zgodna",
        "head body",
        "zasb",
        "cname",
        "kod odpowiedzi",
        "kodowanie treci",
        "wygasa",
        "gmt serwer",
        "pragma",
        "kontrola pamici",
        "podrcznej",
        "data",
        "gmt kontrola",
        "dostpuzezwl na",
        "czytaj wicej",
        "sd okrgowy",
        "jednostki",
        "okrgowy",
        "ogoszenia",
        "sha256",
        "vhash",
        "ssdeep",
        "https odcisk",
        "palca jarma",
        "https dane",
        "v3 numer",
        "odcisk palca",
        "tworzy katalog",
        "tworzy pliki",
        "typ pliku",
        "json",
        "ascii",
        "windows",
        "sqlite",
        "foxpro fpt",
        "links typ",
        "mapa",
        "152 x",
        "sqlite w",
        "sha1",
        "sha512",
        "file size",
        "b file",
        "testing",
        "komornik sdowy",
        "sdzie rejonowym",
        "tomasz rodacki",
        "obwieszczenie",
        "komornicze",
        "tumacza migam",
        "tumacz czynny",
        "zamknite",
        "wiadczenia",
        "schedule",
        "error",
        "javascript",
        "bakers hall",
        "ixaction",
        "script",
        "ixchatlauncher",
        "compatibility",
        "com dla",
        "t1055 pewno",
        "unikanie obrony",
        "t1036 maskarada",
        "t1082 pewno",
        "informacje o",
        "nazwa pliku",
        "dokument pdf",
        "rozmiar pliku",
        "zapowied",
        "type",
        "iii dbt",
        "utf8",
        "dziennik"
      ],
      "references": [
        "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
        "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
        "http://www.jelenia-gora.so.gov.pl/",
        "https://www.jelenia-gora.so.gov.pl/",
        "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
        "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
        "https://www.jelenia-gora.sr.gov.pl/spacer",
        "https://waf.intelix.pl/957476/Chat/Script/Compatibility"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "",
          "display_name": "",
          "target": null
        },
        {
          "id": "serwer",
          "display_name": "serwer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 71,
        "domain": 7651,
        "hostname": 7680,
        "IPv4": 331,
        "FileHash-SHA256": 16168,
        "URL": 10399,
        "FileHash-MD5": 3639,
        "FileHash-SHA1": 3468,
        "CIDR": 4,
        "CVE": 89,
        "YARA": 521,
        "SSLCertFingerprint": 25,
        "JA3": 1,
        "IPv6": 5813
      },
      "indicator_count": 55860,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb4768b06f4da2fba5959b",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:44.270000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "766 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb476d0566c2d07e474df5",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:49.140000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "766 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb476d935dd560b4a3e938",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:49.380000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "766 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb4772c3d3ad1f7accc98a",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:53.179000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "766 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657099644208c92832a9ae92",
      "name": "those ip's JL v2 all suggested ioc's - Data you got \ud83d\ude1c\ud83e\udd37\u200d\u2640\ufe0f",
      "description": "",
      "modified": "2023-12-06T15:55:15.497000",
      "created": "2023-12-06T15:55:15.497000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 4582,
        "FileHash-SHA256": 2374,
        "CVE": 5,
        "domain": 3456,
        "URL": 14212,
        "FileHash-MD5": 13,
        "FileHash-SHA1": 13
      },
      "indicator_count": 24655,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "643746d7f4010b92e37ace06",
      "name": "those ip's JL v2 all suggested ioc's - Data you got \ud83d\ude1c\ud83e\udd37\u200d\u2640\ufe0f",
      "description": "",
      "modified": "2023-04-13T00:03:35.384000",
      "created": "2023-04-13T00:03:35.384000",
      "tags": [],
      "references": [
        "g4991d86fdf3941e589ac92d5848b9f8d260d7afe5e9f47839d69fe03b34b062e.json"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 89,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14212,
        "FileHash-SHA256": 2374,
        "hostname": 4582,
        "domain": 3456,
        "CVE": 5,
        "IPv4": 311,
        "FileHash-MD5": 13,
        "FileHash-SHA1": 13
      },
      "indicator_count": 24966,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 94,
      "modified_text": "1102 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ns1.player1352.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ns1.player1352.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776617132.6427934
}