{
  "type": "URL",
  "indicator": "https://onetrust.makeabeeline.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://onetrust.makeabeeline.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4176348938,
      "indicator": "https://onetrust.makeabeeline.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6964c08bf79bcb252eaa9e15",
          "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
          "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
          "modified": "2026-02-11T09:03:20.933000",
          "created": "2026-01-12T09:36:11.701000",
          "tags": [
            "google",
            "fastly",
            "googlecl",
            "january",
            "http",
            "domain",
            "akamaias",
            "cloudflar",
            "page url",
            "de summary",
            "april",
            "reverse dns",
            "url https",
            "general full",
            "software",
            "united",
            "resource hash",
            "protocol h3",
            "security quic",
            "protocol h2",
            "security tls",
            "main",
            "present jan",
            "title",
            "gmt max",
            "certificate",
            "moved",
            "lowfi",
            "gmt content",
            "meta",
            "present dec",
            "status",
            "aaaa",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "win32",
            "files",
            "verdict",
            "files ip",
            "address",
            "mtb jan",
            "trojandropper",
            "backdoor",
            "win32upatre jan",
            "origin trial",
            "gmt cache",
            "443 ma2592000",
            "possible",
            "worm",
            "trojan",
            "ip address",
            "record value",
            "dark",
            "found",
            "ipv4 add",
            "error",
            "trojanspy",
            "emails",
            "servers",
            "pegasus",
            "america flag",
            "america asn",
            "tlsv1",
            "read c",
            "show",
            "medium",
            "lstockholm",
            "ospotify ab",
            "odigicert inc",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "dynamicloader",
            "yara rule",
            "ms windows",
            "pe32",
            "named pipe",
            "smartassembly",
            "delphi",
            "malware",
            "united states",
            "pe file",
            "filehash",
            "md5 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "high",
            "write c",
            "tls sni",
            "tls handshake",
            "delete",
            "as15169",
            "stun binding",
            "request",
            "port",
            "win64",
            "themida",
            "guard",
            "risepro",
            "sha256",
            "sha1",
            "pattern match",
            "ascii text",
            "size",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "ck techniques",
            "evasion att",
            "t1480 execution",
            "directui",
            "element",
            "hwndhost",
            "classinfobase",
            "hwndelement",
            "value",
            "explorer",
            "insert",
            "movie",
            "hacktool",
            "showing",
            "entries http",
            "scans show",
            "california",
            "location united",
            "next associated",
            "pulse pulses",
            "name servers",
            "found request",
            "unique",
            "url add",
            "related nids",
            "files location",
            "expiration",
            "flag united",
            "present nov",
            "present sep",
            "href",
            "suricata stream",
            "command decode",
            "starfield",
            "encrypt",
            "iframe",
            "date",
            "title error",
            "hostname",
            "pulse submit",
            "memcommit",
            "checks",
            "windows",
            "capture",
            "cloudfront",
            "colorado",
            "creation date",
            "hostname add",
            "eset",
            "binary file",
            "pdb path",
            "internalname",
            "nod32",
            "amon"
          ],
          "references": [
            "open.spotify.com \u2022",
            "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
            "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
            "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
            "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
            "https://target.tccwest.www.littleswimmers.fr/",
            "www.onyx-ware.com \u2022 endgamesystems.com",
            "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Win.Packed.Stealerc-10017074-0",
              "display_name": "Win.Packed.Stealerc-10017074-0",
              "target": null
            },
            {
              "id": "#Lowfi:Win32/AutoIt",
              "display_name": "#Lowfi:Win32/AutoIt",
              "target": "/malware/#Lowfi:Win32/AutoIt"
            },
            {
              "id": "Win.Packed.Generic-9967832-0",
              "display_name": "Win.Packed.Generic-9967832-0",
              "target": null
            },
            {
              "id": "TrojanSpy:MSIL/Yakbeex.A",
              "display_name": "TrojanSpy:MSIL/Yakbeex.A",
              "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Win32:HacktoolX-gen\\ [Trj]",
              "display_name": "Win32:HacktoolX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "nUFS_unicode",
              "display_name": "nUFS_unicode",
              "target": null
            },
            {
              "id": "HackTool:Win32/CobaltStrike.A",
              "display_name": "HackTool:Win32/CobaltStrike.A",
              "target": "/malware/HackTool:Win32/CobaltStrike.A"
            },
            {
              "id": "Win.Dropper.PoisonIvy-9876745-0",
              "display_name": "Win.Dropper.PoisonIvy-9876745-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            }
          ],
          "industries": [
            "Entertainment",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1293,
            "URL": 3389,
            "FileHash-MD5": 635,
            "FileHash-SHA1": 531,
            "FileHash-SHA256": 2345,
            "domain": 501,
            "email": 12,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 8722,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "67 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69612a0df518040b20932bef",
          "name": "Pahamify Pegasus | Palantir Malicious delivery via Bible app downloaded from iOS App Store",
          "description": "Pahamify Pegasus | Requires much further research.\nWorking backwards: Targeted device had a Bible Gateway app download by target from both iOS and Android devices. As per report each time app was accessed, iOS became glitched, passwords stolen, drive by compromise on lock screen prompted target to review app. She found the app login was changed to an unknown users name. I tested a (Bible Gateway) URI to see if her belief BG was a honey pot was true. \nThis may take 2-3 more rounds of research. \nIs Pegasus. Is Palantir. Is intrusive and malicious.\n\n[OTC auto generated Title: 2 Timothy 3 NIV - But mark this: There will be terrible - Bible Gateway]",
          "modified": "2026-02-08T15:00:50.749000",
          "created": "2026-01-09T16:17:17.632000",
          "tags": [
            "defense evasion",
            "cor ta0011",
            "techni process",
            "application l",
            "encrypted ch",
            "christ jesus",
            "just",
            "final charge",
            "timothy10",
            "antioch",
            "iconium",
            "lystra",
            "lord",
            "holy scriptures",
            "scripture",
            "bible gateway",
            "no expiration",
            "expiration",
            "a domains",
            "present sep",
            "united",
            "present jun",
            "meta",
            "present oct",
            "present aug",
            "servers",
            "title",
            "data upload",
            "extraction",
            "palantir foundry",
            "listeners",
            "dev",
            "redirects",
            "redirect health",
            "health data",
            "utc google",
            "utc na",
            "script",
            "utc amazon",
            "bible",
            "meta tags",
            "read",
            "bible reading",
            "trackers google",
            "anchor",
            "analyse headers",
            "contenttype",
            "transferenco",
            "connection",
            "date fri",
            "server",
            "read c",
            "as16509",
            "rgba",
            "unicode",
            "execution",
            "dock",
            "write",
            "persistence",
            "jsvendor",
            "jsapp",
            "script script",
            "cssapp",
            "jsfirebase",
            "moved",
            "urls",
            "pegasus",
            "encrypt",
            "script urls",
            "record value",
            "tls handshake",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "next",
            "capture",
            "malware",
            "unknown",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "access att",
            "t1189 driveby",
            "html",
            "mitre att",
            "ck matrix",
            "ascii text",
            "pattern match",
            "et info",
            "bad traffic",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "adversaries",
            "execution att",
            "t1204 user",
            "t1480 execution",
            "null",
            "refresh",
            "span",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "timothy",
            "search",
            "tag manager",
            "g8t6ln06z40",
            "code",
            "css",
            "js",
            "router",
            "cloudfront",
            "John 12:17",
            "port",
            "yara rule",
            "high",
            "tofsee",
            "rndhex",
            "rndchar",
            "destination",
            "loaderid",
            "lidfileupd",
            "stream"
          ],
          "references": [
            "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV",
            "https://pegasus.pahamify.com/",
            "aptia.palantirfoundry.com \u2022 palantirfoundry.com \u2022\u2019agent-infra-mojito.palantirfoundry.com",
            "equilibrium.palantirfoundry.com \u2022 kt-presales.palantirfoundry.com  \u2022 paloma.palantirfoundry.com",
            "usw-2-dev.palantirfoundry.com \u2022 lucyw.palantirfoundry.com \u2022 https://fegdip.palantirfoundry.com/",
            "http://dasima-containers.palantirfoundry.com/ \u2022 https://glare.palantirfoundry.com/",
            "https://inbound-message-listener-temporary-testing.palantirfoundry.com",
            "https://listeners.usw-16.palantirfoundry.com \u2022 https://pacificlife.palantirfoundry.com/",
            "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master",
            "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.afa33b71-01ea-477c-bc01-f6a3ab623e9d/master",
            "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master",
            "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
            "https://uhsinc.palantirfoundry.com/  \u2022 https://velocityglobal.palantirfoundry.com",
            "https://wes.palantirfoundry.com/ \u2022 http://utilities-bootcamp.palantirfoundry.com/",
            "http://glare.palantirfoundry.com/ \u2022 https://woodward.palantirfoundry.com/",
            "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
            "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd45176426a",
            "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd458176426a",
            "https://pegasus.pahamify.com/ \u2022 https://pegasus.pahamify.com/study-plan/ \u2022 pegasus.pahamify.com",
            "John 12:17"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Bible Gateway",
              "display_name": "Bible Gateway",
              "target": null
            },
            {
              "id": "Pahamify Pegasus",
              "display_name": "Pahamify Pegasus",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1608.004",
              "name": "Drive-by Target",
              "display_name": "T1608.004 - Drive-by Target"
            },
            {
              "id": "T1608.005",
              "name": "Link Target",
              "display_name": "T1608.005 - Link Target"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1192",
              "name": "Spearphishing Link",
              "display_name": "T1192 - Spearphishing Link"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6527,
            "hostname": 2450,
            "FileHash-SHA256": 1716,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 134,
            "domain": 1101,
            "email": 3,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 12184,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "70 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "http://dasima-containers.palantirfoundry.com/ \u2022 https://glare.palantirfoundry.com/",
        "aptia.palantirfoundry.com \u2022 palantirfoundry.com \u2022\u2019agent-infra-mojito.palantirfoundry.com",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.afa33b71-01ea-477c-bc01-f6a3ab623e9d/master",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd458176426a",
        "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV",
        "http://glare.palantirfoundry.com/ \u2022 https://woodward.palantirfoundry.com/",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "https://pegasus.pahamify.com/",
        "https://inbound-message-listener-temporary-testing.palantirfoundry.com",
        "equilibrium.palantirfoundry.com \u2022 kt-presales.palantirfoundry.com  \u2022 paloma.palantirfoundry.com",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master",
        "open.spotify.com \u2022",
        "usw-2-dev.palantirfoundry.com \u2022 lucyw.palantirfoundry.com \u2022 https://fegdip.palantirfoundry.com/",
        "https://wes.palantirfoundry.com/ \u2022 http://utilities-bootcamp.palantirfoundry.com/",
        "https://target.tccwest.www.littleswimmers.fr/",
        "https://listeners.usw-16.palantirfoundry.com \u2022 https://pacificlife.palantirfoundry.com/",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "https://pegasus.pahamify.com/ \u2022 https://pegasus.pahamify.com/study-plan/ \u2022 pegasus.pahamify.com",
        "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
        "John 12:17",
        "https://uhsinc.palantirfoundry.com/  \u2022 https://velocityglobal.palantirfoundry.com",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd45176426a"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.packed.generic-9967832-0",
            "Nufs_unicode",
            "Pahamify pegasus",
            "Win32:hacktoolx-gen\\ [trj]",
            "Et",
            "Win.dropper.poisonivy-9876745-0",
            "Pegasus",
            "Trojanspy",
            "Win.packed.stealerc-10017074-0",
            "Win.trojan.barys-10005825-0",
            "Trojan:win32/zombie.a",
            "Tofsee",
            "#lowfi:win32/autoit",
            "Bible gateway",
            "Hacktool:win32/cobaltstrike.a",
            "Trojanspy:msil/yakbeex.a"
          ],
          "industries": [
            "Technology",
            "Entertainment"
          ],
          "unique_indicators": 20052
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/makeabeeline.com",
    "whois": "http://whois.domaintools.com/makeabeeline.com",
    "domain": "makeabeeline.com",
    "hostname": "onetrust.makeabeeline.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6964c08bf79bcb252eaa9e15",
      "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
      "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
      "modified": "2026-02-11T09:03:20.933000",
      "created": "2026-01-12T09:36:11.701000",
      "tags": [
        "google",
        "fastly",
        "googlecl",
        "january",
        "http",
        "domain",
        "akamaias",
        "cloudflar",
        "page url",
        "de summary",
        "april",
        "reverse dns",
        "url https",
        "general full",
        "software",
        "united",
        "resource hash",
        "protocol h3",
        "security quic",
        "protocol h2",
        "security tls",
        "main",
        "present jan",
        "title",
        "gmt max",
        "certificate",
        "moved",
        "lowfi",
        "gmt content",
        "meta",
        "present dec",
        "status",
        "aaaa",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "win32",
        "files",
        "verdict",
        "files ip",
        "address",
        "mtb jan",
        "trojandropper",
        "backdoor",
        "win32upatre jan",
        "origin trial",
        "gmt cache",
        "443 ma2592000",
        "possible",
        "worm",
        "trojan",
        "ip address",
        "record value",
        "dark",
        "found",
        "ipv4 add",
        "error",
        "trojanspy",
        "emails",
        "servers",
        "pegasus",
        "america flag",
        "america asn",
        "tlsv1",
        "read c",
        "show",
        "medium",
        "lstockholm",
        "ospotify ab",
        "odigicert inc",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "dynamicloader",
        "yara rule",
        "ms windows",
        "pe32",
        "named pipe",
        "smartassembly",
        "delphi",
        "malware",
        "united states",
        "pe file",
        "filehash",
        "md5 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "high",
        "write c",
        "tls sni",
        "tls handshake",
        "delete",
        "as15169",
        "stun binding",
        "request",
        "port",
        "win64",
        "themida",
        "guard",
        "risepro",
        "sha256",
        "sha1",
        "pattern match",
        "ascii text",
        "size",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "ck techniques",
        "evasion att",
        "t1480 execution",
        "directui",
        "element",
        "hwndhost",
        "classinfobase",
        "hwndelement",
        "value",
        "explorer",
        "insert",
        "movie",
        "hacktool",
        "showing",
        "entries http",
        "scans show",
        "california",
        "location united",
        "next associated",
        "pulse pulses",
        "name servers",
        "found request",
        "unique",
        "url add",
        "related nids",
        "files location",
        "expiration",
        "flag united",
        "present nov",
        "present sep",
        "href",
        "suricata stream",
        "command decode",
        "starfield",
        "encrypt",
        "iframe",
        "date",
        "title error",
        "hostname",
        "pulse submit",
        "memcommit",
        "checks",
        "windows",
        "capture",
        "cloudfront",
        "colorado",
        "creation date",
        "hostname add",
        "eset",
        "binary file",
        "pdb path",
        "internalname",
        "nod32",
        "amon"
      ],
      "references": [
        "open.spotify.com \u2022",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "https://target.tccwest.www.littleswimmers.fr/",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Win.Packed.Stealerc-10017074-0",
          "display_name": "Win.Packed.Stealerc-10017074-0",
          "target": null
        },
        {
          "id": "#Lowfi:Win32/AutoIt",
          "display_name": "#Lowfi:Win32/AutoIt",
          "target": "/malware/#Lowfi:Win32/AutoIt"
        },
        {
          "id": "Win.Packed.Generic-9967832-0",
          "display_name": "Win.Packed.Generic-9967832-0",
          "target": null
        },
        {
          "id": "TrojanSpy:MSIL/Yakbeex.A",
          "display_name": "TrojanSpy:MSIL/Yakbeex.A",
          "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Win32:HacktoolX-gen\\ [Trj]",
          "display_name": "Win32:HacktoolX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "nUFS_unicode",
          "display_name": "nUFS_unicode",
          "target": null
        },
        {
          "id": "HackTool:Win32/CobaltStrike.A",
          "display_name": "HackTool:Win32/CobaltStrike.A",
          "target": "/malware/HackTool:Win32/CobaltStrike.A"
        },
        {
          "id": "Win.Dropper.PoisonIvy-9876745-0",
          "display_name": "Win.Dropper.PoisonIvy-9876745-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        }
      ],
      "industries": [
        "Entertainment",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1293,
        "URL": 3389,
        "FileHash-MD5": 635,
        "FileHash-SHA1": 531,
        "FileHash-SHA256": 2345,
        "domain": 501,
        "email": 12,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 8722,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "67 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69612a0df518040b20932bef",
      "name": "Pahamify Pegasus | Palantir Malicious delivery via Bible app downloaded from iOS App Store",
      "description": "Pahamify Pegasus | Requires much further research.\nWorking backwards: Targeted device had a Bible Gateway app download by target from both iOS and Android devices. As per report each time app was accessed, iOS became glitched, passwords stolen, drive by compromise on lock screen prompted target to review app. She found the app login was changed to an unknown users name. I tested a (Bible Gateway) URI to see if her belief BG was a honey pot was true. \nThis may take 2-3 more rounds of research. \nIs Pegasus. Is Palantir. Is intrusive and malicious.\n\n[OTC auto generated Title: 2 Timothy 3 NIV - But mark this: There will be terrible - Bible Gateway]",
      "modified": "2026-02-08T15:00:50.749000",
      "created": "2026-01-09T16:17:17.632000",
      "tags": [
        "defense evasion",
        "cor ta0011",
        "techni process",
        "application l",
        "encrypted ch",
        "christ jesus",
        "just",
        "final charge",
        "timothy10",
        "antioch",
        "iconium",
        "lystra",
        "lord",
        "holy scriptures",
        "scripture",
        "bible gateway",
        "no expiration",
        "expiration",
        "a domains",
        "present sep",
        "united",
        "present jun",
        "meta",
        "present oct",
        "present aug",
        "servers",
        "title",
        "data upload",
        "extraction",
        "palantir foundry",
        "listeners",
        "dev",
        "redirects",
        "redirect health",
        "health data",
        "utc google",
        "utc na",
        "script",
        "utc amazon",
        "bible",
        "meta tags",
        "read",
        "bible reading",
        "trackers google",
        "anchor",
        "analyse headers",
        "contenttype",
        "transferenco",
        "connection",
        "date fri",
        "server",
        "read c",
        "as16509",
        "rgba",
        "unicode",
        "execution",
        "dock",
        "write",
        "persistence",
        "jsvendor",
        "jsapp",
        "script script",
        "cssapp",
        "jsfirebase",
        "moved",
        "urls",
        "pegasus",
        "encrypt",
        "script urls",
        "record value",
        "tls handshake",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "next",
        "capture",
        "malware",
        "unknown",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "access att",
        "t1189 driveby",
        "html",
        "mitre att",
        "ck matrix",
        "ascii text",
        "pattern match",
        "et info",
        "bad traffic",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "adversaries",
        "execution att",
        "t1204 user",
        "t1480 execution",
        "null",
        "refresh",
        "span",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "timothy",
        "search",
        "tag manager",
        "g8t6ln06z40",
        "code",
        "css",
        "js",
        "router",
        "cloudfront",
        "John 12:17",
        "port",
        "yara rule",
        "high",
        "tofsee",
        "rndhex",
        "rndchar",
        "destination",
        "loaderid",
        "lidfileupd",
        "stream"
      ],
      "references": [
        "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV",
        "https://pegasus.pahamify.com/",
        "aptia.palantirfoundry.com \u2022 palantirfoundry.com \u2022\u2019agent-infra-mojito.palantirfoundry.com",
        "equilibrium.palantirfoundry.com \u2022 kt-presales.palantirfoundry.com  \u2022 paloma.palantirfoundry.com",
        "usw-2-dev.palantirfoundry.com \u2022 lucyw.palantirfoundry.com \u2022 https://fegdip.palantirfoundry.com/",
        "http://dasima-containers.palantirfoundry.com/ \u2022 https://glare.palantirfoundry.com/",
        "https://inbound-message-listener-temporary-testing.palantirfoundry.com",
        "https://listeners.usw-16.palantirfoundry.com \u2022 https://pacificlife.palantirfoundry.com/",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.878cb49b-395c-4c82-8db8-5e2bb0e628ce/master",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.afa33b71-01ea-477c-bc01-f6a3ab623e9d/master",
        "https://paloma.palantirfoundry.com/workspace/data-health/redirect/ri.foundry.main.dataset.ce31c01d-0b84-4e29-906f-1b8057568d49/master",
        "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
        "https://uhsinc.palantirfoundry.com/  \u2022 https://velocityglobal.palantirfoundry.com",
        "https://wes.palantirfoundry.com/ \u2022 http://utilities-bootcamp.palantirfoundry.com/",
        "http://glare.palantirfoundry.com/ \u2022 https://woodward.palantirfoundry.com/",
        "https://sfmg-testing.palantirfoundry.com\t\u2022 https://signup.palantirfoundry.com/",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd45176426a",
        "https://paloma.palantirfoundry.com/workspace/module/view/latest/ri.workshop.main.module.cee847ce-7689-42e8-8ca4-bd458176426a",
        "https://pegasus.pahamify.com/ \u2022 https://pegasus.pahamify.com/study-plan/ \u2022 pegasus.pahamify.com",
        "John 12:17"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Bible Gateway",
          "display_name": "Bible Gateway",
          "target": null
        },
        {
          "id": "Pahamify Pegasus",
          "display_name": "Pahamify Pegasus",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1608.004",
          "name": "Drive-by Target",
          "display_name": "T1608.004 - Drive-by Target"
        },
        {
          "id": "T1608.005",
          "name": "Link Target",
          "display_name": "T1608.005 - Link Target"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1192",
          "name": "Spearphishing Link",
          "display_name": "T1192 - Spearphishing Link"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6527,
        "hostname": 2450,
        "FileHash-SHA256": 1716,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 134,
        "domain": 1101,
        "email": 3,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 12184,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "70 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://onetrust.makeabeeline.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://onetrust.makeabeeline.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776622083.2509067
}