{
  "type": "URL",
  "indicator": "https://praxatel.dn2.n-helix.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://praxatel.dn2.n-helix.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4275673012,
      "indicator": "https://praxatel.dn2.n-helix.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69bf261cc4e399447d78776c",
          "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
          "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
          "modified": "2026-04-20T21:01:07.869000",
          "created": "2026-03-21T23:13:32.760000",
          "tags": [
            "sc data",
            "data upload",
            "please sub",
            "include data",
            "extraction",
            "failed",
            "sc pulse",
            "idron anv",
            "extr please",
            "include review",
            "exclude sugges",
            "stop show",
            "typ domain",
            "united",
            "virtool",
            "name servers",
            "cryp",
            "emails",
            "win32",
            "ip address",
            "worm",
            "trojan",
            "learn",
            "suspicious",
            "informative",
            "ck id",
            "name tactics",
            "command",
            "adversaries",
            "spawns",
            "ssl certificate",
            "initial access",
            "link initial",
            "prefetch8",
            "mitre att",
            "ck matrix",
            "flag",
            "windows nt",
            "win64",
            "accept",
            "encrypt",
            "form",
            "hybrid",
            "bypass",
            "general",
            "path",
            "iframe",
            "click",
            "strings",
            "anchor https",
            "anchor",
            "liberal",
            "sabey",
            "liberal friends",
            "meta",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "info initial",
            "access ta0001",
            "compromise",
            "t1189 network",
            "communication",
            "get http",
            "artifacts v",
            "full reports",
            "v get",
            "help dns",
            "resolutions",
            "ip traffic",
            "extr data",
            "enter sc",
            "extra data",
            "referen",
            "broth",
            "passive dns",
            "urls",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "none google",
            "safe browsing",
            "inquest labs",
            "lucas acha",
            "code integrity",
            "checks creation",
            "otx logo",
            "all hostname",
            "files",
            "domain",
            "protect",
            "date",
            "title",
            "exchange",
            "se http",
            "present jan",
            "present feb",
            "present dec",
            "backdoor",
            "certificate",
            "all domain",
            "alibaba cloud",
            "hichina",
            "porkbun llc",
            "cloudflare",
            "namecheap inc",
            "namecheap",
            "domains",
            "dynadot llc",
            "ascio",
            "denmark",
            "url https",
            "filehashsha256",
            "url http",
            "dopple ai",
            "snit",
            "iocs",
            "otx description",
            "information",
            "report spam",
            "delete service",
            "poem",
            "hunter",
            "malicious",
            "porn revenge",
            "brian sabeys",
            "all report",
            "spam delete",
            "rl http",
            "https",
            "expiration http",
            "spam brian",
            "swipper",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashmd5",
            "filehashsha1",
            "sha256",
            "scan",
            "learn more",
            "indicators show",
            "tbmvid",
            "sourcelnms",
            "zx1724209326040",
            "xxx videos",
            "xxxvideohd",
            "adversary",
            "packing",
            "palantir.com",
            "discovery",
            "victim won case",
            "doin it",
            "palantirian abuse",
            "apple",
            "sabey data centers",
            "insurance",
            "quasi government",
            "the brother sabey",
            "reimer",
            "law enforcement",
            "vessel state",
            "sabey porn",
            "hall evans",
            "christopher ahmann",
            "defamation",
            "google"
          ],
          "references": [
            "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
            "http://watchhers.net/index.php",
            "http://212.33.237.86/images/1/report.php",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://webmail.police.govmm.org/owa/",
            "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
            "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
            "Mark Brian Sabey",
            "Melvin Sabey",
            "Christopher P \u2018Buzz\u2019 Ahmann",
            "Ronda Cordova",
            "Unknown Persons impersonating Private Investigators (plural)",
            "Quasi Government Case",
            "Victim silenced. Struck by Car Driven by male police let walk",
            "Denver Police let this attempted murder walk. Cited him as a ghost driver",
            "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
            "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
            "Reimer was a PT. Unknown whereabouts , name or job description",
            "Denver Police Department Major Crimes closed investigation",
            "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
            "I bring up the personal nature of the crime because a delete service has been used",
            "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
            "All IoC\u2019s originate from sources named. There are some unknown attackers",
            "This is a serious crime. I\u2019m certain God WILL pay them.",
            "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
            "http://palantirwww.sweetheartvideo.com/ (weirdness)",
            "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2-lbl.dvr.dn2.n-helix.com/",
            "https://207-207-25-201.fwd.datafoundry.com/",
            "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
            "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2sdbl.dvr.dn2.n-helix.com/",
            "Updated | What\u2019s left after theft",
            "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
            "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
            "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
            "https://www.datafoundry.com/category/news/press-releases/",
            "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
            "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
            "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
            "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
            "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
            "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
            "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
            "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
            "Some may may find this content is very disturbing and offensive"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Porn Revenge",
              "display_name": "Porn Revenge",
              "target": null
            },
            {
              "id": "Tons of Malware",
              "display_name": "Tons of Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1132.001",
              "name": "Standard Encoding",
              "display_name": "T1132.001 - Standard Encoding"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1495",
              "name": "Firmware Corruption",
              "display_name": "T1495 - Firmware Corruption"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1593.001",
              "name": "Social Media",
              "display_name": "T1593.001 - Social Media"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584",
              "name": "Compromise Infrastructure",
              "display_name": "T1584 - Compromise Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6034,
            "domain": 1422,
            "FileHash-MD5": 274,
            "FileHash-SHA1": 252,
            "FileHash-SHA256": 3378,
            "email": 11,
            "hostname": 2753,
            "CVE": 1,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 14134,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "41 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bdecb269c9d6fad107de1f",
          "name": "Google - BOT Beacon | Ransomware present | Active phishing campaigns",
          "description": "",
          "modified": "2026-04-20T00:26:28.752000",
          "created": "2026-03-21T00:56:18.458000",
          "tags": [
            "dynamicloader",
            "get na",
            "high",
            "request",
            "google",
            "write c",
            "explorer",
            "malware",
            "virus",
            "polyransom",
            "ransom",
            "phishing",
            "cnc",
            "virlock",
            "system impact",
            "encrypts user",
            "slows",
            "ransom",
            "4 detection",
            "removal modern",
            "kaspersky",
            "3 prevention",
            "tips",
            "modifies itself",
            "polymorphic ransomware",
            "encrypts files",
            "\"parasitic\" virus",
            "modifies existing files",
            "spreader",
            "google llc",
            "file Infection",
            "algorithm",
            "ouno sni",
            "key usage",
            "data",
            "v3 serial",
            "number",
            "public key",
            "info",
            "key algorithm",
            "subject key",
            "self-signed",
            "mitre att",
            "defense evasion",
            "ta0005",
            "software",
            "evasion",
            "artifacts v",
            "full reports",
            "v help",
            "dns resolutions",
            "traffic udp",
            "hashes",
            "trojan",
            "redirects",
            "ms windows",
            "pe32",
            "users",
            "medium",
            "yara rule",
            "cache",
            "search",
            "intel",
            "music",
            "write",
            "unknown",
            "virtool",
            "copy",
            "guard",
            "suspicious",
            "defender",
            "launch",
            "tracker",
            "media",
            "next"
          ],
          "references": [
            "External Hosts: COUNTRY ASN 142.251.33.206\tgoogle.com |google.comUnited StatesAS15169 google llc",
            "IDS Detections: SUSPICIOUS Possible automated connectivity check (www.google.com)",
            "IDS Detections: Terse Unencrypted Request for Google - Likely Connectivity Check",
            "Yara Detections: UPX",
            "Alerts: antisandbox_sleep hardware_id_profiling physical_drive_access suspicious_iocontrol_codes",
            "Alerts: process_creation_suspicious_location infostealer_browser apc_injection persistence_autorun",
            "Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert antivm_bochs_keys",
            "Alerts: antivm_generic_disk deletes_executed_files disables_uac folder_enumeration",
            "Alerts: stealth_hidden_extension stealth_hiddenreg suspicious_command",
            "142.250.147.101 \u2022 142.251.33.206 command_and_control",
            "http://142.251.33.206/ phishing",
            "http://www.forensickb.com/2013/03/file-entropy-explained.html  phishing",
            "invalid2.invalid   4259517cd4e48a289d332ab3f0ab52a366322824",
            "System Impact: Once active, it typically: Encrypts user data and locks the screen.",
            "System Impact: Slows down system performance.",
            "System Impact: Attempts to spread to network shares and cloud storage",
            "Ransom Demands: Like other ransomware, it demands payment (often in cryptocurrency) to restore access to files or the system.",
            "Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
            "Matches rule MALWARE-CNC Win.Malware.Ramnit outbound REGISTER_BOT beacon",
            "Matches rule ET MALWARE Win32/Ramnit Checkin Unique rule identifier: This rule belongs to a private collection."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win.Virus.PolyRansom-5704625-0",
              "display_name": "Win.Virus.PolyRansom-5704625-0",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1044",
              "name": "File System Permissions Weakness",
              "display_name": "T1044 - File System Permissions Weakness"
            },
            {
              "id": "T1222.001",
              "name": "Windows File and Directory Permissions Modification",
              "display_name": "T1222.001 - Windows File and Directory Permissions Modification"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 431,
            "FileHash-MD5": 123,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 478,
            "domain": 141,
            "hostname": 199,
            "email": 1,
            "CIDR": 1
          },
          "indicator_count": 1407,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "42 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "System Impact: Attempts to spread to network shares and cloud storage",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "Matches rule ET MALWARE Win32/Ramnit Checkin Unique rule identifier: This rule belongs to a private collection.",
        "Some may may find this content is very disturbing and offensive",
        "https://www.datafoundry.com/category/news/press-releases/",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "Alerts: antisandbox_sleep hardware_id_profiling physical_drive_access suspicious_iocontrol_codes",
        "http://watchhers.net/index.php",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "Ronda Cordova",
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "External Hosts: COUNTRY ASN 142.251.33.206\tgoogle.com |google.comUnited StatesAS15169 google llc",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "Alerts: process_creation_suspicious_location infostealer_browser apc_injection persistence_autorun",
        "Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "Yara Detections: UPX",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://webmail.police.govmm.org/owa/",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "Ransom Demands: Like other ransomware, it demands payment (often in cryptocurrency) to restore access to files or the system.",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "http://142.251.33.206/ phishing",
        "https://rdweb.datafoundry.com/",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "Updated | What\u2019s left after theft",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "Denver Police Department Major Crimes closed investigation",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "Unknown Persons impersonating Private Investigators (plural)",
        "Quasi Government Case",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "Alerts: antivm_generic_disk deletes_executed_files disables_uac folder_enumeration",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert antivm_bochs_keys",
        "System Impact: Once active, it typically: Encrypts user data and locks the screen.",
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "System Impact: Slows down system performance.",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "142.250.147.101 \u2022 142.251.33.206 command_and_control",
        "Melvin Sabey",
        "IDS Detections: Terse Unencrypted Request for Google - Likely Connectivity Check",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "IDS Detections: SUSPICIOUS Possible automated connectivity check (www.google.com)",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "Mark Brian Sabey",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "http://www.forensickb.com/2013/03/file-entropy-explained.html  phishing",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "Alerts: stealth_hidden_extension stealth_hiddenreg suspicious_command",
        "http://212.33.237.86/images/1/report.php",
        "Matches rule MALWARE-CNC Win.Malware.Ramnit outbound REGISTER_BOT beacon",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "I bring up the personal nature of the crime because a delete service has been used",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "invalid2.invalid   4259517cd4e48a289d332ab3f0ab52a366322824"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Porn revenge",
            "Other malware",
            "Tons of malware",
            "Win.virus.polyransom-5704625-0"
          ],
          "industries": [],
          "unique_indicators": 16422
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/n-helix.com",
    "whois": "http://whois.domaintools.com/n-helix.com",
    "domain": "n-helix.com",
    "hostname": "praxatel.dn2.n-helix.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69bf261cc4e399447d78776c",
      "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
      "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
      "modified": "2026-04-20T21:01:07.869000",
      "created": "2026-03-21T23:13:32.760000",
      "tags": [
        "sc data",
        "data upload",
        "please sub",
        "include data",
        "extraction",
        "failed",
        "sc pulse",
        "idron anv",
        "extr please",
        "include review",
        "exclude sugges",
        "stop show",
        "typ domain",
        "united",
        "virtool",
        "name servers",
        "cryp",
        "emails",
        "win32",
        "ip address",
        "worm",
        "trojan",
        "learn",
        "suspicious",
        "informative",
        "ck id",
        "name tactics",
        "command",
        "adversaries",
        "spawns",
        "ssl certificate",
        "initial access",
        "link initial",
        "prefetch8",
        "mitre att",
        "ck matrix",
        "flag",
        "windows nt",
        "win64",
        "accept",
        "encrypt",
        "form",
        "hybrid",
        "bypass",
        "general",
        "path",
        "iframe",
        "click",
        "strings",
        "anchor https",
        "anchor",
        "liberal",
        "sabey",
        "liberal friends",
        "meta",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "info initial",
        "access ta0001",
        "compromise",
        "t1189 network",
        "communication",
        "get http",
        "artifacts v",
        "full reports",
        "v get",
        "help dns",
        "resolutions",
        "ip traffic",
        "extr data",
        "enter sc",
        "extra data",
        "referen",
        "broth",
        "passive dns",
        "urls",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "none google",
        "safe browsing",
        "inquest labs",
        "lucas acha",
        "code integrity",
        "checks creation",
        "otx logo",
        "all hostname",
        "files",
        "domain",
        "protect",
        "date",
        "title",
        "exchange",
        "se http",
        "present jan",
        "present feb",
        "present dec",
        "backdoor",
        "certificate",
        "all domain",
        "alibaba cloud",
        "hichina",
        "porkbun llc",
        "cloudflare",
        "namecheap inc",
        "namecheap",
        "domains",
        "dynadot llc",
        "ascio",
        "denmark",
        "url https",
        "filehashsha256",
        "url http",
        "dopple ai",
        "snit",
        "iocs",
        "otx description",
        "information",
        "report spam",
        "delete service",
        "poem",
        "hunter",
        "malicious",
        "porn revenge",
        "brian sabeys",
        "all report",
        "spam delete",
        "rl http",
        "https",
        "expiration http",
        "spam brian",
        "swipper",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashmd5",
        "filehashsha1",
        "sha256",
        "scan",
        "learn more",
        "indicators show",
        "tbmvid",
        "sourcelnms",
        "zx1724209326040",
        "xxx videos",
        "xxxvideohd",
        "adversary",
        "packing",
        "palantir.com",
        "discovery",
        "victim won case",
        "doin it",
        "palantirian abuse",
        "apple",
        "sabey data centers",
        "insurance",
        "quasi government",
        "the brother sabey",
        "reimer",
        "law enforcement",
        "vessel state",
        "sabey porn",
        "hall evans",
        "christopher ahmann",
        "defamation",
        "google"
      ],
      "references": [
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "http://watchhers.net/index.php",
        "http://212.33.237.86/images/1/report.php",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://webmail.police.govmm.org/owa/",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "Mark Brian Sabey",
        "Melvin Sabey",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "Ronda Cordova",
        "Unknown Persons impersonating Private Investigators (plural)",
        "Quasi Government Case",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "Denver Police Department Major Crimes closed investigation",
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "I bring up the personal nature of the crime because a delete service has been used",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "Updated | What\u2019s left after theft",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "https://www.datafoundry.com/category/news/press-releases/",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "Some may may find this content is very disturbing and offensive"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Porn Revenge",
          "display_name": "Porn Revenge",
          "target": null
        },
        {
          "id": "Tons of Malware",
          "display_name": "Tons of Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1132.001",
          "name": "Standard Encoding",
          "display_name": "T1132.001 - Standard Encoding"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1495",
          "name": "Firmware Corruption",
          "display_name": "T1495 - Firmware Corruption"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1593.001",
          "name": "Social Media",
          "display_name": "T1593.001 - Social Media"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584",
          "name": "Compromise Infrastructure",
          "display_name": "T1584 - Compromise Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6034,
        "domain": 1422,
        "FileHash-MD5": 274,
        "FileHash-SHA1": 252,
        "FileHash-SHA256": 3378,
        "email": 11,
        "hostname": 2753,
        "CVE": 1,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 14134,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "41 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bdecb269c9d6fad107de1f",
      "name": "Google - BOT Beacon | Ransomware present | Active phishing campaigns",
      "description": "",
      "modified": "2026-04-20T00:26:28.752000",
      "created": "2026-03-21T00:56:18.458000",
      "tags": [
        "dynamicloader",
        "get na",
        "high",
        "request",
        "google",
        "write c",
        "explorer",
        "malware",
        "virus",
        "polyransom",
        "ransom",
        "phishing",
        "cnc",
        "virlock",
        "system impact",
        "encrypts user",
        "slows",
        "ransom",
        "4 detection",
        "removal modern",
        "kaspersky",
        "3 prevention",
        "tips",
        "modifies itself",
        "polymorphic ransomware",
        "encrypts files",
        "\"parasitic\" virus",
        "modifies existing files",
        "spreader",
        "google llc",
        "file Infection",
        "algorithm",
        "ouno sni",
        "key usage",
        "data",
        "v3 serial",
        "number",
        "public key",
        "info",
        "key algorithm",
        "subject key",
        "self-signed",
        "mitre att",
        "defense evasion",
        "ta0005",
        "software",
        "evasion",
        "artifacts v",
        "full reports",
        "v help",
        "dns resolutions",
        "traffic udp",
        "hashes",
        "trojan",
        "redirects",
        "ms windows",
        "pe32",
        "users",
        "medium",
        "yara rule",
        "cache",
        "search",
        "intel",
        "music",
        "write",
        "unknown",
        "virtool",
        "copy",
        "guard",
        "suspicious",
        "defender",
        "launch",
        "tracker",
        "media",
        "next"
      ],
      "references": [
        "External Hosts: COUNTRY ASN 142.251.33.206\tgoogle.com |google.comUnited StatesAS15169 google llc",
        "IDS Detections: SUSPICIOUS Possible automated connectivity check (www.google.com)",
        "IDS Detections: Terse Unencrypted Request for Google - Likely Connectivity Check",
        "Yara Detections: UPX",
        "Alerts: antisandbox_sleep hardware_id_profiling physical_drive_access suspicious_iocontrol_codes",
        "Alerts: process_creation_suspicious_location infostealer_browser apc_injection persistence_autorun",
        "Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert antivm_bochs_keys",
        "Alerts: antivm_generic_disk deletes_executed_files disables_uac folder_enumeration",
        "Alerts: stealth_hidden_extension stealth_hiddenreg suspicious_command",
        "142.250.147.101 \u2022 142.251.33.206 command_and_control",
        "http://142.251.33.206/ phishing",
        "http://www.forensickb.com/2013/03/file-entropy-explained.html  phishing",
        "invalid2.invalid   4259517cd4e48a289d332ab3f0ab52a366322824",
        "System Impact: Once active, it typically: Encrypts user data and locks the screen.",
        "System Impact: Slows down system performance.",
        "System Impact: Attempts to spread to network shares and cloud storage",
        "Ransom Demands: Like other ransomware, it demands payment (often in cryptocurrency) to restore access to files or the system.",
        "Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "Matches rule MALWARE-CNC Win.Malware.Ramnit outbound REGISTER_BOT beacon",
        "Matches rule ET MALWARE Win32/Ramnit Checkin Unique rule identifier: This rule belongs to a private collection."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win.Virus.PolyRansom-5704625-0",
          "display_name": "Win.Virus.PolyRansom-5704625-0",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1044",
          "name": "File System Permissions Weakness",
          "display_name": "T1044 - File System Permissions Weakness"
        },
        {
          "id": "T1222.001",
          "name": "Windows File and Directory Permissions Modification",
          "display_name": "T1222.001 - Windows File and Directory Permissions Modification"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 431,
        "FileHash-MD5": 123,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 478,
        "domain": 141,
        "hostname": 199,
        "email": 1,
        "CIDR": 1
      },
      "indicator_count": 1407,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "42 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://praxatel.dn2.n-helix.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://praxatel.dn2.n-helix.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780344980.168975
}