{
  "type": "URL",
  "indicator": "https://prometheus.local.advena.io",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://prometheus.local.advena.io",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3857241871,
      "indicator": "https://prometheus.local.advena.io",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "663d2869e0f3a42bbddc42ff",
          "name": "UPX executable packer.",
          "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
          "modified": "2024-10-14T00:01:17.069000",
          "created": "2024-05-09T19:47:53.786000",
          "tags": [
            "cioch adrian",
            "centrum usug",
            "sieciowych",
            "elf binary",
            "upx compression",
            "roth",
            "nextron",
            "info",
            "javascript",
            "html",
            "office open",
            "xml document",
            "network capture",
            "win32 exe",
            "xml pakietu",
            "pdf zestawy",
            "przechwytywanie",
            "office",
            "filehashsha1",
            "url https",
            "cve cve20201070",
            "cve cve20203153",
            "cve cve20201048",
            "cve cve20211732",
            "cve20201048 apr",
            "filehashmd5",
            "cve cve20010901",
            "cve cve20021841",
            "cve20153202 apr",
            "cve cve20160728",
            "cve cve20161807",
            "cve cve20175123",
            "cve20185407 apr",
            "cve cve20054605",
            "cve cve20060745",
            "cve cve20070452",
            "cve cve20070453",
            "cve cve20070454",
            "cve cve20071355",
            "cve cve20071358",
            "cve cve20071871",
            "cve20149614 apr",
            "cve cve20151503",
            "cve cve20152080",
            "cve cve20157377",
            "cve cve20170131",
            "cve20200796 may",
            "cve cve20113403"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6861,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 5771,
            "domain": 3139,
            "URL": 14525,
            "FileHash-SHA1": 2610,
            "IPv4": 108,
            "CIDR": 40,
            "FileHash-SHA256": 10705,
            "FileHash-MD5": 3373,
            "YARA": 2,
            "CVE": 148,
            "Mutex": 7,
            "FilePath": 3,
            "SSLCertFingerprint": 3,
            "email": 23,
            "JA3": 1,
            "IPv6": 2
          },
          "indicator_count": 40460,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "552 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6663311a8c529069bb34a06f",
          "name": "Injection | Win.Worm.Mydoom | Ransomware | Android Device attack",
          "description": "Android device, remotely modified, hidden users, 'zombie' device, targeting, framing, unknown admin.",
          "modified": "2024-07-07T15:00:25.739000",
          "created": "2024-06-07T16:11:06.485000",
          "tags": [
            "november",
            "threat roundup",
            "axelo",
            "atkafij0",
            "referrer",
            "historical ssl",
            "dynamicloader",
            "write c",
            "yara rule",
            "delete c",
            "ms windows",
            "medium",
            "yara detections",
            "show",
            "search",
            "united",
            "write",
            "copy",
            "create c",
            "read c",
            "flashpix",
            "high",
            "template",
            "persistence",
            "execution",
            "next",
            "unknown",
            "shared address",
            "html info",
            "title rfc",
            "ipv4 prefix",
            "space meta",
            "tags",
            "prefix",
            "space",
            "script tags",
            "anchor hrefs",
            "sha256",
            "vhash",
            "ssdeep",
            "html internet",
            "magic html",
            "ascii text",
            "magika html",
            "file size",
            "internet",
            "iana",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "iana special",
            "detections type",
            "name",
            "win32 exe",
            "runresdll",
            "android",
            "trojan",
            "files",
            "installer",
            "10357",
            "javascript",
            "malibot",
            "pe32",
            "intel",
            "linux x8664",
            "khtml",
            "win32",
            "process32nextw",
            "discovery",
            "discovery t1057",
            "t1057",
            "t1045",
            "memcommit",
            "regopenkeyexw",
            "regsetvalueexa",
            "writeconsolea",
            "minute tr",
            "highest f",
            "regdword",
            "del f",
            "start",
            "memreserve",
            "dock"
          ],
          "references": [
            "http://tools.ietf.org/html/rfc6598 | Found in android device| Block: 100:116.200.0/? [Special Use /Non - IANA]",
            "AV Detection: Win.Downloader.68062-1 | Yara Detections: MS_Visual_Basic_6_0 ,  Cabinet_Archive",
            "High Priority Alerts: dead_host network_icmp dumped_buffer2 nolookup_communication modifies_certificates",
            "Alerts: dumped_buffer network_http allocates_rwx antisandbox_sleep antivm_disk_size exe_appdata antivm_network_adapters privilege_luid_check",
            "Alerts: antivm_queries_computername checks_debugger recon_fingerprint antivm_memory_available",
            "Image: https://otx.alienvault.com/otxapi/indicators/file/screenshot/a674df2469cb894b79343bdedfb2068c124746003678826f9281f69887200811",
            "https://otx.alienvault.com/indicator/file/a674df2469cb894b79343bdedfb2068c124746003678826f9281f69887200811 [Win.Downloader.68062-1]",
            "https://otx.alienvault.com/indicator/file/0000374bffccbcd54ea9a1c51514b671a8caf732ef3bef2cc8cccd4bf01665cf [Win.Worm.Mydoom-5]",
            "Yara Detections: Nrv2x , upx_3 ,  UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX",
            "High Priority Alerts: procmem_yara network_bind persistence_autorun",
            "Alerts: dynamic_function_loading powershell_download reads_self suspicious_tld dead_connect",
            "buildbot.tools.ietf.org [Win32:Malware-gen]",
            "Yara Detections: MS_Visual_Cpp_2008 | High Priority Alerts:  dead_host network_icmp",
            "Priority Alerts: dumped_buffer network_http suspicious_tld allocates_rwx creates_exe exe_appdata antivm_network_adapters pe_features",
            "Yara: Detections Skype User-Agent detected, LZMA"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win.Downloader.68062-1",
              "display_name": "Win.Downloader.68062-1",
              "target": null
            },
            {
              "id": "Win.Worm.Mydoom-5",
              "display_name": "Win.Worm.Mydoom-5",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Hera.A!bit",
              "display_name": "Backdoor:Win32/Hera.A!bit",
              "target": "/malware/Backdoor:Win32/Hera.A!bit"
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 350,
            "FileHash-SHA1": 318,
            "FileHash-SHA256": 1929,
            "URL": 1885,
            "hostname": 1600,
            "domain": 1380,
            "email": 7,
            "SSLCertFingerprint": 40
          },
          "indicator_count": 7509,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "651 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6681f6f2cd37f508d362c2db",
          "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
          "description": "",
          "modified": "2024-07-01T00:23:14.084000",
          "created": "2024-07-01T00:23:14.084000",
          "tags": [
            "united",
            "passive dns",
            "as14449",
            "moved",
            "urls",
            "authority",
            "body",
            "object",
            "certificate",
            "scan endpoints",
            "unknown",
            "date",
            "as11377",
            "as16552 tiggee",
            "as174 cogent",
            "ireland unknown",
            "cname",
            "as11404 wave",
            "all scoreblue",
            "pulse pulses",
            "entries",
            "ipv4",
            "pulse submit",
            "url analysis",
            "dynamicloader",
            "port",
            "destination",
            "high",
            "medium",
            "windows",
            "cmd c",
            "default",
            "document file",
            "v2 document",
            "write",
            "copy",
            "name verdict",
            "falcon sandbox",
            "sha1",
            "sha256",
            "misc attack",
            "mitre att",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "ascii text",
            "hybrid",
            "starfield",
            "click",
            "strings",
            "core",
            "contact",
            "as396982 google",
            "historical ssl",
            "referrer",
            "co20230203",
            "malware",
            "discord",
            "credential",
            "lunar client",
            "trendmicro av",
            "neural netw",
            "upscayl",
            "steam game",
            "server",
            "domain status",
            "registrar abuse",
            "google",
            "community",
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "664fceb9e0acfc0baee851c2",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 75,
            "URL": 3584,
            "domain": 836,
            "hostname": 1749,
            "FileHash-SHA256": 726,
            "FileHash-MD5": 88,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 7068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "657 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "664fceb9e0acfc0baee851c2",
          "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
          "description": "Tags, findings of this report is auto generated by Level Blue OTX.AlienVault.\nPer my research: \nMalicious Score: 10/10\nAlerts: Alerts\nransomware_file_modifications, script_created_process, stealth_network, infostealer_cookies, suspicious_command_tools,\ndynamic_function_loading, reads_self,\nstealth_window, cmdline_http_link, uses_windows_utilities, antidebug_setunhandledexceptionfilter, cmdline_terminate, stealth_timeout,\n\nAffected Device: Apples iOS Ipad, Update 17.5.1\npegasystems.voicestorm.com -Cisco Umbrella {permanently moved as of 5.23.2024} found in Apple link - http://apps.apple.com/app/, nsis, downloaders,injection, data local, remotewd devices, tracking,",
          "modified": "2024-06-22T23:05:37.577000",
          "created": "2024-05-23T23:18:17.563000",
          "tags": [
            "united",
            "passive dns",
            "as14449",
            "moved",
            "urls",
            "authority",
            "body",
            "object",
            "certificate",
            "scan endpoints",
            "unknown",
            "date",
            "as11377",
            "as16552 tiggee",
            "as174 cogent",
            "ireland unknown",
            "cname",
            "as11404 wave",
            "all scoreblue",
            "pulse pulses",
            "entries",
            "ipv4",
            "pulse submit",
            "url analysis",
            "dynamicloader",
            "port",
            "destination",
            "high",
            "medium",
            "windows",
            "cmd c",
            "default",
            "document file",
            "v2 document",
            "write",
            "copy",
            "name verdict",
            "falcon sandbox",
            "sha1",
            "sha256",
            "misc attack",
            "mitre att",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "ascii text",
            "hybrid",
            "starfield",
            "click",
            "strings",
            "core",
            "contact",
            "as396982 google",
            "historical ssl",
            "referrer",
            "co20230203",
            "malware",
            "discord",
            "credential",
            "lunar client",
            "trendmicro av",
            "neural netw",
            "upscayl",
            "steam game",
            "server",
            "domain status",
            "registrar abuse",
            "google",
            "community",
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 75,
            "URL": 3584,
            "domain": 836,
            "hostname": 1749,
            "FileHash-SHA256": 726,
            "FileHash-MD5": 88,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 7068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "665 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f4ba867ec44a4dc0e6fc96",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com",
          "description": "Jiuxiu Live - High-quality beauty online video interactive community - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -porn dump. Performed tiny DNS test on affected target. \nDNS stuffing  pornography. DNSpionage , custom browser, DNS tunneling encoding  data, programs, protocols, DNS queries, responses, amplification attack; perform  (DDoS) on server, flood attack,  spoofing.  Attack. Miles IT & affiliated logging inas target. Pitfall of being compromised for some; you won't speak to legitimate business unless you know & recognize voice. \nSome notations in references.",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-15T21:15:50.802000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 60,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "736 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f980ad16123b5d52f5f76f",
          "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com [Report originated from octoseek]",
          "description": "",
          "modified": "2024-04-13T11:00:32.548000",
          "created": "2024-03-19T12:10:21.291000",
          "tags": [
            "q htpps",
            "g htpps",
            "q https",
            "virustotal",
            "exif standard",
            "tiff image",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "default",
            "jpeg image",
            "search",
            "copy",
            "code",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "next",
            "create c",
            "delete c",
            "intel",
            "ms windows",
            "pe32",
            "precreate read",
            "united",
            "show",
            "regsetvalueexa",
            "trojan",
            "markus",
            "mozilla",
            "write c",
            "json",
            "entries",
            "ascii text",
            "data",
            "as15169",
            "error",
            "malware",
            "win64",
            "denmark as32934",
            "ip hostname",
            "reverse ip",
            "lookup country",
            "as7018 att",
            "as14618",
            "as54113",
            "country code",
            "as36081 state",
            "redirect chain",
            "redirection",
            "location",
            "lakewood",
            "emails",
            "as name",
            "ssl certificate",
            "whois record",
            "k0pmbc",
            "spsfsb",
            "zwdk9d",
            "vwdzfe",
            "contacted",
            "referrer",
            "ntmzac",
            "historical ssl",
            "august",
            "hacktool",
            "core",
            "agent tesla",
            "emotet",
            "chaos",
            "ransomexx",
            "quasar",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "markmonitor",
            "epic games",
            "iana id",
            "contact phone",
            "domain status",
            "registrar whois",
            "registrar",
            "win32 exe",
            "python",
            "launchres",
            "win32 dll",
            "unrealengine",
            "detections type",
            "name",
            "bundled",
            "ctsu",
            "smokeloader",
            "privateloader",
            "relic",
            "monitoring",
            "startpage",
            "\u7f8e\u5973\u76f4\u64ad",
            "\u7f8e\u5973\u89c6\u9891",
            "\u7f8e\u5973\u4e3b\u64ad",
            "\u89c6\u9891\u804a\u5929",
            "\u89c6\u9891\u4ea4\u53cb",
            "\u7f8e\u5973\u4ea4\u53cb",
            "\u7f8e\u5973\u79c0\u573a",
            "\u6e05\u7eaf\u7f8e\u5973",
            "\u6027\u611f\u7f8e\u5973",
            "\u7f8e\u5973\u4e92\u52a8",
            "\u7f8e\u5973\u804a\u5929",
            "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
            "\u7f8e\u5973\u76f4\u64ad\u95f4",
            "\u7f8e\u5973\u804a\u5929\u5ba4",
            "icp2021030667",
            "0110542",
            "copyright",
            "rights reserved",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "siblings",
            "parent domain",
            "cname",
            "whitelisted",
            "status",
            "as15169 google",
            "asnone united",
            "servers",
            "aaaa",
            "body",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "site top",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "million alexa",
            "site safe",
            "malicious site",
            "unsafe",
            "alexa",
            "riskware",
            "artemis",
            "blacknet rat",
            "quasar rat",
            "crack",
            "presenoker",
            "dapato",
            "stealer",
            "phish",
            "memscan",
            "nsis",
            "phishing",
            "bulz",
            "maltiverse",
            "trojanspy",
            "blacknet",
            "zbot",
            "aig",
            "unknown",
            "passive dns",
            "urls",
            "expiresthu",
            "gmt path",
            "scan endpoints",
            "encrypt",
            "dynamicloader",
            "high",
            "medium",
            "qaeaav12",
            "windows",
            "cape",
            "windows wget",
            "suspicious",
            "powershell",
            "canvas",
            "form",
            "showing",
            "all octoseek",
            "url https",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "cus cnr3",
            "olet",
            "l http",
            "wifi",
            "wifi access",
            "wifi hotspot",
            "wifi internet",
            "southwest wifi",
            "inflight",
            "inflight entertainment",
            "southwest",
            "comedy",
            "internet",
            "strong",
            "drama",
            "google chrome",
            "business select",
            "internet access",
            "apple safari",
            "book",
            "rapid",
            "love",
            "summer",
            "poppy",
            "floyd",
            "district",
            "jackson",
            "kevin",
            "live",
            "music",
            "upgrade",
            "gift",
            "lost",
            "carol",
            "canada",
            "cobalt strike",
            "malicious",
            "fragtor",
            "phishing paypal",
            "mail spammer"
          ],
          "references": [
            "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
            "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
            "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
            "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
            "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
            "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
            "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
            "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
            "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
            "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
            "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
            "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
            "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
            "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
            "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
            "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
            "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
            "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
            "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
            "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
            "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
            "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
            "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
            "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
            "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
            "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
            "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
            "Self whitelisting tool, domains moved within nginx."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Bulz",
              "display_name": "Bulz",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Fragtor",
              "display_name": "Fragtor",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65f4ba867ec44a4dc0e6fc96",
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8753,
            "domain": 1525,
            "hostname": 3740,
            "FileHash-SHA256": 6746,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 509,
            "SSLCertFingerprint": 3,
            "CVE": 8,
            "CIDR": 5,
            "email": 7
          },
          "indicator_count": 21915,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 235,
          "modified_text": "736 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "Alerts: antivm_queries_computername checks_debugger recon_fingerprint antivm_memory_available",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "AV Detection: Win.Downloader.68062-1 | Yara Detections: MS_Visual_Basic_6_0 ,  Cabinet_Archive",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "Yara Detections: MS_Visual_Cpp_2008 | High Priority Alerts:  dead_host network_icmp",
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "buildbot.tools.ietf.org [Win32:Malware-gen]",
        "Alerts: dumped_buffer network_http allocates_rwx antisandbox_sleep antivm_disk_size exe_appdata antivm_network_adapters privilege_luid_check",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "http://tools.ietf.org/html/rfc6598 | Found in android device| Block: 100:116.200.0/? [Special Use /Non - IANA]",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Yara Detections: Nrv2x , upx_3 ,  UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "High Priority Alerts: dead_host network_icmp dumped_buffer2 nolookup_communication modifies_certificates",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Image: https://otx.alienvault.com/otxapi/indicators/file/screenshot/a674df2469cb894b79343bdedfb2068c124746003678826f9281f69887200811",
        "https://otx.alienvault.com/indicator/file/a674df2469cb894b79343bdedfb2068c124746003678826f9281f69887200811 [Win.Downloader.68062-1]",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Alerts: dynamic_function_loading powershell_download reads_self suspicious_tld dead_connect",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Self whitelisting tool, domains moved within nginx.",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/indicator/file/0000374bffccbcd54ea9a1c51514b671a8caf732ef3bef2cc8cccd4bf01665cf [Win.Worm.Mydoom-5]",
        "Priority Alerts: dumped_buffer network_http suspicious_tld allocates_rwx creates_exe exe_appdata antivm_network_adapters pe_features",
        "Yara: Detections Skype User-Agent detected, LZMA",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "High Priority Alerts: procmem_yara network_bind persistence_autorun",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.downloader.68062-1",
            "Maltiverse",
            "Quasar",
            "Blacknet",
            "Bulz",
            "Backdoor:win32/hera.a!bit",
            "Win32:trojan-gen",
            "Zbot",
            "Win.worm.mydoom-5",
            "Fragtor",
            "Trojanspy"
          ],
          "industries": [],
          "unique_indicators": 66868
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/advena.io",
    "whois": "http://whois.domaintools.com/advena.io",
    "domain": "advena.io",
    "hostname": "prometheus.local.advena.io"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "663d2869e0f3a42bbddc42ff",
      "name": "UPX executable packer.",
      "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
      "modified": "2024-10-14T00:01:17.069000",
      "created": "2024-05-09T19:47:53.786000",
      "tags": [
        "cioch adrian",
        "centrum usug",
        "sieciowych",
        "elf binary",
        "upx compression",
        "roth",
        "nextron",
        "info",
        "javascript",
        "html",
        "office open",
        "xml document",
        "network capture",
        "win32 exe",
        "xml pakietu",
        "pdf zestawy",
        "przechwytywanie",
        "office",
        "filehashsha1",
        "url https",
        "cve cve20201070",
        "cve cve20203153",
        "cve cve20201048",
        "cve cve20211732",
        "cve20201048 apr",
        "filehashmd5",
        "cve cve20010901",
        "cve cve20021841",
        "cve20153202 apr",
        "cve cve20160728",
        "cve cve20161807",
        "cve cve20175123",
        "cve20185407 apr",
        "cve cve20054605",
        "cve cve20060745",
        "cve cve20070452",
        "cve cve20070453",
        "cve cve20070454",
        "cve cve20071355",
        "cve cve20071358",
        "cve cve20071871",
        "cve20149614 apr",
        "cve cve20151503",
        "cve cve20152080",
        "cve cve20157377",
        "cve cve20170131",
        "cve20200796 may",
        "cve cve20113403"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6861,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 5771,
        "domain": 3139,
        "URL": 14525,
        "FileHash-SHA1": 2610,
        "IPv4": 108,
        "CIDR": 40,
        "FileHash-SHA256": 10705,
        "FileHash-MD5": 3373,
        "YARA": 2,
        "CVE": 148,
        "Mutex": 7,
        "FilePath": 3,
        "SSLCertFingerprint": 3,
        "email": 23,
        "JA3": 1,
        "IPv6": 2
      },
      "indicator_count": 40460,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "552 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6663311a8c529069bb34a06f",
      "name": "Injection | Win.Worm.Mydoom | Ransomware | Android Device attack",
      "description": "Android device, remotely modified, hidden users, 'zombie' device, targeting, framing, unknown admin.",
      "modified": "2024-07-07T15:00:25.739000",
      "created": "2024-06-07T16:11:06.485000",
      "tags": [
        "november",
        "threat roundup",
        "axelo",
        "atkafij0",
        "referrer",
        "historical ssl",
        "dynamicloader",
        "write c",
        "yara rule",
        "delete c",
        "ms windows",
        "medium",
        "yara detections",
        "show",
        "search",
        "united",
        "write",
        "copy",
        "create c",
        "read c",
        "flashpix",
        "high",
        "template",
        "persistence",
        "execution",
        "next",
        "unknown",
        "shared address",
        "html info",
        "title rfc",
        "ipv4 prefix",
        "space meta",
        "tags",
        "prefix",
        "space",
        "script tags",
        "anchor hrefs",
        "sha256",
        "vhash",
        "ssdeep",
        "html internet",
        "magic html",
        "ascii text",
        "magika html",
        "file size",
        "internet",
        "iana",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "iana special",
        "detections type",
        "name",
        "win32 exe",
        "runresdll",
        "android",
        "trojan",
        "files",
        "installer",
        "10357",
        "javascript",
        "malibot",
        "pe32",
        "intel",
        "linux x8664",
        "khtml",
        "win32",
        "process32nextw",
        "discovery",
        "discovery t1057",
        "t1057",
        "t1045",
        "memcommit",
        "regopenkeyexw",
        "regsetvalueexa",
        "writeconsolea",
        "minute tr",
        "highest f",
        "regdword",
        "del f",
        "start",
        "memreserve",
        "dock"
      ],
      "references": [
        "http://tools.ietf.org/html/rfc6598 | Found in android device| Block: 100:116.200.0/? [Special Use /Non - IANA]",
        "AV Detection: Win.Downloader.68062-1 | Yara Detections: MS_Visual_Basic_6_0 ,  Cabinet_Archive",
        "High Priority Alerts: dead_host network_icmp dumped_buffer2 nolookup_communication modifies_certificates",
        "Alerts: dumped_buffer network_http allocates_rwx antisandbox_sleep antivm_disk_size exe_appdata antivm_network_adapters privilege_luid_check",
        "Alerts: antivm_queries_computername checks_debugger recon_fingerprint antivm_memory_available",
        "Image: https://otx.alienvault.com/otxapi/indicators/file/screenshot/a674df2469cb894b79343bdedfb2068c124746003678826f9281f69887200811",
        "https://otx.alienvault.com/indicator/file/a674df2469cb894b79343bdedfb2068c124746003678826f9281f69887200811 [Win.Downloader.68062-1]",
        "https://otx.alienvault.com/indicator/file/0000374bffccbcd54ea9a1c51514b671a8caf732ef3bef2cc8cccd4bf01665cf [Win.Worm.Mydoom-5]",
        "Yara Detections: Nrv2x , upx_3 ,  UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX",
        "High Priority Alerts: procmem_yara network_bind persistence_autorun",
        "Alerts: dynamic_function_loading powershell_download reads_self suspicious_tld dead_connect",
        "buildbot.tools.ietf.org [Win32:Malware-gen]",
        "Yara Detections: MS_Visual_Cpp_2008 | High Priority Alerts:  dead_host network_icmp",
        "Priority Alerts: dumped_buffer network_http suspicious_tld allocates_rwx creates_exe exe_appdata antivm_network_adapters pe_features",
        "Yara: Detections Skype User-Agent detected, LZMA"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win.Downloader.68062-1",
          "display_name": "Win.Downloader.68062-1",
          "target": null
        },
        {
          "id": "Win.Worm.Mydoom-5",
          "display_name": "Win.Worm.Mydoom-5",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Hera.A!bit",
          "display_name": "Backdoor:Win32/Hera.A!bit",
          "target": "/malware/Backdoor:Win32/Hera.A!bit"
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 350,
        "FileHash-SHA1": 318,
        "FileHash-SHA256": 1929,
        "URL": 1885,
        "hostname": 1600,
        "domain": 1380,
        "email": 7,
        "SSLCertFingerprint": 40
      },
      "indicator_count": 7509,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "651 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6681f6f2cd37f508d362c2db",
      "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
      "description": "",
      "modified": "2024-07-01T00:23:14.084000",
      "created": "2024-07-01T00:23:14.084000",
      "tags": [
        "united",
        "passive dns",
        "as14449",
        "moved",
        "urls",
        "authority",
        "body",
        "object",
        "certificate",
        "scan endpoints",
        "unknown",
        "date",
        "as11377",
        "as16552 tiggee",
        "as174 cogent",
        "ireland unknown",
        "cname",
        "as11404 wave",
        "all scoreblue",
        "pulse pulses",
        "entries",
        "ipv4",
        "pulse submit",
        "url analysis",
        "dynamicloader",
        "port",
        "destination",
        "high",
        "medium",
        "windows",
        "cmd c",
        "default",
        "document file",
        "v2 document",
        "write",
        "copy",
        "name verdict",
        "falcon sandbox",
        "sha1",
        "sha256",
        "misc attack",
        "mitre att",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "ascii text",
        "hybrid",
        "starfield",
        "click",
        "strings",
        "core",
        "contact",
        "as396982 google",
        "historical ssl",
        "referrer",
        "co20230203",
        "malware",
        "discord",
        "credential",
        "lunar client",
        "trendmicro av",
        "neural netw",
        "upscayl",
        "steam game",
        "server",
        "domain status",
        "registrar abuse",
        "google",
        "community",
        "record type",
        "ttl value",
        "data",
        "v3 serial",
        "number"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "664fceb9e0acfc0baee851c2",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 75,
        "URL": 3584,
        "domain": 836,
        "hostname": 1749,
        "FileHash-SHA256": 726,
        "FileHash-MD5": 88,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 7068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "657 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "664fceb9e0acfc0baee851c2",
      "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
      "description": "Tags, findings of this report is auto generated by Level Blue OTX.AlienVault.\nPer my research: \nMalicious Score: 10/10\nAlerts: Alerts\nransomware_file_modifications, script_created_process, stealth_network, infostealer_cookies, suspicious_command_tools,\ndynamic_function_loading, reads_self,\nstealth_window, cmdline_http_link, uses_windows_utilities, antidebug_setunhandledexceptionfilter, cmdline_terminate, stealth_timeout,\n\nAffected Device: Apples iOS Ipad, Update 17.5.1\npegasystems.voicestorm.com -Cisco Umbrella {permanently moved as of 5.23.2024} found in Apple link - http://apps.apple.com/app/, nsis, downloaders,injection, data local, remotewd devices, tracking,",
      "modified": "2024-06-22T23:05:37.577000",
      "created": "2024-05-23T23:18:17.563000",
      "tags": [
        "united",
        "passive dns",
        "as14449",
        "moved",
        "urls",
        "authority",
        "body",
        "object",
        "certificate",
        "scan endpoints",
        "unknown",
        "date",
        "as11377",
        "as16552 tiggee",
        "as174 cogent",
        "ireland unknown",
        "cname",
        "as11404 wave",
        "all scoreblue",
        "pulse pulses",
        "entries",
        "ipv4",
        "pulse submit",
        "url analysis",
        "dynamicloader",
        "port",
        "destination",
        "high",
        "medium",
        "windows",
        "cmd c",
        "default",
        "document file",
        "v2 document",
        "write",
        "copy",
        "name verdict",
        "falcon sandbox",
        "sha1",
        "sha256",
        "misc attack",
        "mitre att",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "ascii text",
        "hybrid",
        "starfield",
        "click",
        "strings",
        "core",
        "contact",
        "as396982 google",
        "historical ssl",
        "referrer",
        "co20230203",
        "malware",
        "discord",
        "credential",
        "lunar client",
        "trendmicro av",
        "neural netw",
        "upscayl",
        "steam game",
        "server",
        "domain status",
        "registrar abuse",
        "google",
        "community",
        "record type",
        "ttl value",
        "data",
        "v3 serial",
        "number"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 75,
        "URL": 3584,
        "domain": 836,
        "hostname": 1749,
        "FileHash-SHA256": 726,
        "FileHash-MD5": 88,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 7068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "665 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f4ba867ec44a4dc0e6fc96",
      "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com",
      "description": "Jiuxiu Live - High-quality beauty online video interactive community - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -porn dump. Performed tiny DNS test on affected target. \nDNS stuffing  pornography. DNSpionage , custom browser, DNS tunneling encoding  data, programs, protocols, DNS queries, responses, amplification attack; perform  (DDoS) on server, flood attack,  spoofing.  Attack. Miles IT & affiliated logging inas target. Pitfall of being compromised for some; you won't speak to legitimate business unless you know & recognize voice. \nSome notations in references.",
      "modified": "2024-04-13T11:00:32.548000",
      "created": "2024-03-15T21:15:50.802000",
      "tags": [
        "q htpps",
        "g htpps",
        "q https",
        "virustotal",
        "exif standard",
        "tiff image",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "default",
        "jpeg image",
        "search",
        "copy",
        "code",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "next",
        "create c",
        "delete c",
        "intel",
        "ms windows",
        "pe32",
        "precreate read",
        "united",
        "show",
        "regsetvalueexa",
        "trojan",
        "markus",
        "mozilla",
        "write c",
        "json",
        "entries",
        "ascii text",
        "data",
        "as15169",
        "error",
        "malware",
        "win64",
        "denmark as32934",
        "ip hostname",
        "reverse ip",
        "lookup country",
        "as7018 att",
        "as14618",
        "as54113",
        "country code",
        "as36081 state",
        "redirect chain",
        "redirection",
        "location",
        "lakewood",
        "emails",
        "as name",
        "ssl certificate",
        "whois record",
        "k0pmbc",
        "spsfsb",
        "zwdk9d",
        "vwdzfe",
        "contacted",
        "referrer",
        "ntmzac",
        "historical ssl",
        "august",
        "hacktool",
        "core",
        "agent tesla",
        "emotet",
        "chaos",
        "ransomexx",
        "quasar",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "markmonitor",
        "epic games",
        "iana id",
        "contact phone",
        "domain status",
        "registrar whois",
        "registrar",
        "win32 exe",
        "python",
        "launchres",
        "win32 dll",
        "unrealengine",
        "detections type",
        "name",
        "bundled",
        "ctsu",
        "smokeloader",
        "privateloader",
        "relic",
        "monitoring",
        "startpage",
        "\u7f8e\u5973\u76f4\u64ad",
        "\u7f8e\u5973\u89c6\u9891",
        "\u7f8e\u5973\u4e3b\u64ad",
        "\u89c6\u9891\u804a\u5929",
        "\u89c6\u9891\u4ea4\u53cb",
        "\u7f8e\u5973\u4ea4\u53cb",
        "\u7f8e\u5973\u79c0\u573a",
        "\u6e05\u7eaf\u7f8e\u5973",
        "\u6027\u611f\u7f8e\u5973",
        "\u7f8e\u5973\u4e92\u52a8",
        "\u7f8e\u5973\u804a\u5929",
        "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
        "\u7f8e\u5973\u76f4\u64ad\u95f4",
        "\u7f8e\u5973\u804a\u5929\u5ba4",
        "icp2021030667",
        "0110542",
        "copyright",
        "rights reserved",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "siblings",
        "parent domain",
        "cname",
        "whitelisted",
        "status",
        "as15169 google",
        "asnone united",
        "servers",
        "aaaa",
        "body",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "site top",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "million alexa",
        "site safe",
        "malicious site",
        "unsafe",
        "alexa",
        "riskware",
        "artemis",
        "blacknet rat",
        "quasar rat",
        "crack",
        "presenoker",
        "dapato",
        "stealer",
        "phish",
        "memscan",
        "nsis",
        "phishing",
        "bulz",
        "maltiverse",
        "trojanspy",
        "blacknet",
        "zbot",
        "aig",
        "unknown",
        "passive dns",
        "urls",
        "expiresthu",
        "gmt path",
        "scan endpoints",
        "encrypt",
        "dynamicloader",
        "high",
        "medium",
        "qaeaav12",
        "windows",
        "cape",
        "windows wget",
        "suspicious",
        "powershell",
        "canvas",
        "form",
        "showing",
        "all octoseek",
        "url https",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "cus cnr3",
        "olet",
        "l http",
        "wifi",
        "wifi access",
        "wifi hotspot",
        "wifi internet",
        "southwest wifi",
        "inflight",
        "inflight entertainment",
        "southwest",
        "comedy",
        "internet",
        "strong",
        "drama",
        "google chrome",
        "business select",
        "internet access",
        "apple safari",
        "book",
        "rapid",
        "love",
        "summer",
        "poppy",
        "floyd",
        "district",
        "jackson",
        "kevin",
        "live",
        "music",
        "upgrade",
        "gift",
        "lost",
        "carol",
        "canada",
        "cobalt strike",
        "malicious",
        "fragtor",
        "phishing paypal",
        "mail spammer"
      ],
      "references": [
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Self whitelisting tool, domains moved within nginx."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Bulz",
          "display_name": "Bulz",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Fragtor",
          "display_name": "Fragtor",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 60,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8753,
        "domain": 1525,
        "hostname": 3740,
        "FileHash-SHA256": 6746,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 509,
        "SSLCertFingerprint": 3,
        "CVE": 8,
        "CIDR": 5,
        "email": 7
      },
      "indicator_count": 21915,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "736 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f980ad16123b5d52f5f76f",
      "name": "DNS Hijacking - \u4e5d\u79c0\u76f4\u64ad-\u9ad8\u54c1\u8d28\u7f8e\u5973\u5728\u7ebf\u89c6\u9891\u4e92\u52a8\u793e\u533a -MilesIT.com [Report originated from octoseek]",
      "description": "",
      "modified": "2024-04-13T11:00:32.548000",
      "created": "2024-03-19T12:10:21.291000",
      "tags": [
        "q htpps",
        "g htpps",
        "q https",
        "virustotal",
        "exif standard",
        "tiff image",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "default",
        "jpeg image",
        "search",
        "copy",
        "code",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "next",
        "create c",
        "delete c",
        "intel",
        "ms windows",
        "pe32",
        "precreate read",
        "united",
        "show",
        "regsetvalueexa",
        "trojan",
        "markus",
        "mozilla",
        "write c",
        "json",
        "entries",
        "ascii text",
        "data",
        "as15169",
        "error",
        "malware",
        "win64",
        "denmark as32934",
        "ip hostname",
        "reverse ip",
        "lookup country",
        "as7018 att",
        "as14618",
        "as54113",
        "country code",
        "as36081 state",
        "redirect chain",
        "redirection",
        "location",
        "lakewood",
        "emails",
        "as name",
        "ssl certificate",
        "whois record",
        "k0pmbc",
        "spsfsb",
        "zwdk9d",
        "vwdzfe",
        "contacted",
        "referrer",
        "ntmzac",
        "historical ssl",
        "august",
        "hacktool",
        "core",
        "agent tesla",
        "emotet",
        "chaos",
        "ransomexx",
        "quasar",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "markmonitor",
        "epic games",
        "iana id",
        "contact phone",
        "domain status",
        "registrar whois",
        "registrar",
        "win32 exe",
        "python",
        "launchres",
        "win32 dll",
        "unrealengine",
        "detections type",
        "name",
        "bundled",
        "ctsu",
        "smokeloader",
        "privateloader",
        "relic",
        "monitoring",
        "startpage",
        "\u7f8e\u5973\u76f4\u64ad",
        "\u7f8e\u5973\u89c6\u9891",
        "\u7f8e\u5973\u4e3b\u64ad",
        "\u89c6\u9891\u804a\u5929",
        "\u89c6\u9891\u4ea4\u53cb",
        "\u7f8e\u5973\u4ea4\u53cb",
        "\u7f8e\u5973\u79c0\u573a",
        "\u6e05\u7eaf\u7f8e\u5973",
        "\u6027\u611f\u7f8e\u5973",
        "\u7f8e\u5973\u4e92\u52a8",
        "\u7f8e\u5973\u804a\u5929",
        "\u7f8e\u5973\u5728\u7ebf\u8868\u6f14",
        "\u7f8e\u5973\u76f4\u64ad\u95f4",
        "\u7f8e\u5973\u804a\u5929\u5ba4",
        "icp2021030667",
        "0110542",
        "copyright",
        "rights reserved",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "siblings",
        "parent domain",
        "cname",
        "whitelisted",
        "status",
        "as15169 google",
        "asnone united",
        "servers",
        "aaaa",
        "body",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "site top",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "million alexa",
        "site safe",
        "malicious site",
        "unsafe",
        "alexa",
        "riskware",
        "artemis",
        "blacknet rat",
        "quasar rat",
        "crack",
        "presenoker",
        "dapato",
        "stealer",
        "phish",
        "memscan",
        "nsis",
        "phishing",
        "bulz",
        "maltiverse",
        "trojanspy",
        "blacknet",
        "zbot",
        "aig",
        "unknown",
        "passive dns",
        "urls",
        "expiresthu",
        "gmt path",
        "scan endpoints",
        "encrypt",
        "dynamicloader",
        "high",
        "medium",
        "qaeaav12",
        "windows",
        "cape",
        "windows wget",
        "suspicious",
        "powershell",
        "canvas",
        "form",
        "showing",
        "all octoseek",
        "url https",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "cus cnr3",
        "olet",
        "l http",
        "wifi",
        "wifi access",
        "wifi hotspot",
        "wifi internet",
        "southwest wifi",
        "inflight",
        "inflight entertainment",
        "southwest",
        "comedy",
        "internet",
        "strong",
        "drama",
        "google chrome",
        "business select",
        "internet access",
        "apple safari",
        "book",
        "rapid",
        "love",
        "summer",
        "poppy",
        "floyd",
        "district",
        "jackson",
        "kevin",
        "live",
        "music",
        "upgrade",
        "gift",
        "lost",
        "carol",
        "canada",
        "cobalt strike",
        "malicious",
        "fragtor",
        "phishing paypal",
        "mail spammer"
      ],
      "references": [
        "https://www.9xiuzb.com/activity/activity_pcunion?piusr=t_420",
        "tracking.epicgames.com | epicgames.com | https://www.epicgames.com/id/activate",
        "Conneted to Network: drcody@milesit.com | milesit.com | milestechnologies.com | info.milestechnologies.com | www.milesit.com | www.milestechnologies.com",
        "Conneted to Network: http://seed.wavebrowser.co/seed?osname=win&channel=stable&milestone=1 | f16ac036e3.nxcli.net",
        "Conneted to Network: https://getconnected.southwestwifi.com | www.coloradoltcpartnership.org",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/233e5b27962a141061eff04ae07699d1a2faa8d47077a2da31770a5f59327ee3",
        "https://otx.alienvault.com/indicator/file/58d35aa65e820e83be595049b9e5a223ffb1f5f9111b64ccdd2622479cda9e1b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/f0d38614f706da3a08acdf7188eac139a352621ccada40e5e22d191412acc357",
        "Phone purchased for target by a 'self-proclaimed' W/F PI from Lakewood, Colorado w/o consent/prior knowledge. PI fitful, so target paid for phone.",
        "Found claims PI was a hacker. Brother a hitman. Verbalized non-specific affiliation w/City of Lakewood. Refused to provide target phone passcode.",
        "Target admits to ignoring major signs: 'PI' called just before request submitted.Spent hours researching & denouncing targets former 'questionable 'PI",
        "'PI' feigned high concern for target, begged her to meet at 10 P.M. Target refused. Target states she will only meet in safe public spot in daylight.",
        "'PI' arrives in separate car w/unseen veteran. Points out DV LP to target , states he's not with her. Leads target to restaurant 'to talk'. Stays awhile.",
        "'PI' orders 2 meals. Leaves restaurant a few times. Talks about troubled mother  w/medication addictions. Incredibly emotional vowing to be better.",
        "Emotionally demands disabled target cash advanced to pay all bills. Denies formerly alleged abilities & skills, still wants $1500 for 4 hours of nothing.",
        "Of note: Alleging Federal Investigator calls target. Found her in Bark? No. He asks for $4G to relocate target in 2 days provide hacker secured iPhone.",
        "'PI' claims to have information. Sends  picture of who he claims is attacker now millionaire owner of Mile High Sports & Rehabilitation. Asks if she knew.",
        "Target knows nothing about assaulter. Chicago Fed  text photo for target to confirm identity of attacker. Be sends a photo of Dr. John T. Sasha.",
        "Target was treated by Dr. Sasha, was not assaulter. Target relays Law Firm dropped her as she refused to include Sasha in Injury claim.",
        "Goal to present targets case, blame & have Sacha removed by board of Colorado attorneys. Widely known firm angrily begins misconduct in her case.",
        "Fed alleged if Sasha was in cahoots she could get millions. Target again refused. Alleging Chicago Fed contends be needs  to move her 50+ miles.",
        "Fed lost interest after satisfied Sasha wasn't of interest. Target interest to rid self of hackers and stalkers. Inundated with  calls from fake PI's.",
        "Colorado doesn't require a PI licensure. That's a major problem as many stalkers, malicious hackers & the ruthless are drawn to this occupation.",
        "Metro T-Mobile refuses refund. Allows target to store phone with them in resealed box. When retrieved box opened and tampered with.",
        "Issues: Target contacted a single PI from a very compromised device, received sealed as gift from trusted person via provider. Others contact her.",
        "I know this isn't a blog. If someone is targeted, every device will be compromised. It's the goal of the attackers. Unwarranted bounty found.",
        "Law enforcement aware and assure target in person she's not a suspect in any crime is Colorado or nationally. All DA's, law enforcement PI's check.",
        "You can either have a runner or become a hacker. Only  2 choices for targeted individuals. Target needs to become ethical hacker or ethical grey hat, Purple teamer.",
        "Device security reset temporarily before epicgames[.]com a resource being used attempted to self download.  Relentless...",
        "Self whitelisting tool, domains moved within nginx."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Bulz",
          "display_name": "Bulz",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Fragtor",
          "display_name": "Fragtor",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65f4ba867ec44a4dc0e6fc96",
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8753,
        "domain": 1525,
        "hostname": 3740,
        "FileHash-SHA256": 6746,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 509,
        "SSLCertFingerprint": 3,
        "CVE": 8,
        "CIDR": 5,
        "email": 7
      },
      "indicator_count": 21915,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 235,
      "modified_text": "736 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://prometheus.local.advena.io",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://prometheus.local.advena.io",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776622752.1420019
}