{ "type": "URL", "indicator": "https://prometheusintelligencetechnology.com/404javascript.js", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://prometheusintelligencetechnology.com/404javascript.js", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4098395180, "indicator": "https://prometheusintelligencetechnology.com/404javascript.js", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "69560fa62bddc3d965359168", "name": "Mirai H5DATACENTERS.COM \u2022 Regis University Blackout | Extranet", "description": "It was Data Center 5. \nH5DATACENTERS.COM \u2022 Regis University Blackout PrometheusIntelligenceTechnology.com - Extranet. Forced out of RU for finding malicious link that targeted , tracked ,conversations , behavior, etc., \u201cNo one willingly signed up to be tracked.\u201dis what Tsara told Dean Archer. He said he\u2019d never seen anything like this in his life. RU ignored the risks Tsara cautioned could irreparably damage incoming students college experience and negatively impact their future. I just hope the many students who attended do not continue to suffer. Guess who the villain was? The truth teller. \n\nToday activity has stepped up. Somehow the PIT Pulse has caused a crusade of aggressive following and investigation. \n\nThere may be 10,000 vs 1 in this battle. But the One is God.", "modified": "2026-01-31T03:04:09.490000", "created": "2026-01-01T06:09:42.057000", "tags": [ "http", "files related", "related tags", "ipv4", "ccus asnas20029", "urls", "domain", "files ip", "address domain", "ip whois", "passive dns", "gmt path", "hostname add", "files", "united", "a li", "trackingpin a", "ip address", "unknown aaaa", "error", "back", "darkness", "present sep", "a domains", "script urls", "unknown ns", "script domains", "meta", "apache", "body doctype", "gmt server", "url analysis", "path", "accept", "pragma", "west domains", "present dec", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "data upload", "extraction", "found", "datacenter", "hosting", "vps reverse", "america united", "america asn", "as398101", "body html", "head title", "title", "status", "name servers", "failed", "all se", "enter sc", "type", "extra data", "referen", "manualv add", "indicator data", "port", "destination", "south korea", "china as4134", "taiwan as3462", "as3786 lg", "as4766 korea", "as9318 sk", "high", "tcp syn", "trojan", "pegasus", "malware", "unknown", "search", "present jan", "pur sta", "uni idc", "cao oti", "dsp cor", "body", "win32", "united states", "pulse tags", "palantir", "ad maven", "technology", "url https", "url http", "indicator role", "title added", "active related", "Palantir", "Ad-Maven", "Palantir", "Ad- Maven", "Prometheus Intelligence Technology", "skynet", "starfield tech", "flock", "report spam", "palantir ad", "maven", "botnet", "created", "days ago", "education", "tsara", "mirai", "regis", "brashears", "discovery", "universities", "tsara brashears", "close", "stop", "ransom", "capture", "denver" ], "references": [ "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM", "https://prometheusintelligencetechnology.com/pit/", "https://prometheusintelligencetechnology.com/404javascript.js", "https://www.secureserver.net/default404.aspx", "http://ocsp.starfieldtech.com/ 443 Certificate", "https://www.secureserver.net/default404.aspx Server: Microsoft-IIS/7.0", "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/ P3P:", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "Powered-By: ARR/2.5 X-Powered-By: ASP.NET", "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found Content-Length: 161", "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )", "Certificate Crldistributionpoints", "http://crl.starfieldtech.com/sfig2s2-0.crl 443", "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net", "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers", "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443", "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443", "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443", "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer", "http://certs.starfieldtech.com/repository/ 443", "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443", "A Domains \u2022 www.secureserver.net 443 Certificate", "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx", "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found Cache-Control: private", "Content-Length: 160 Location: http://www.secureserver.net/default404.aspx", "Server: Microsoft-IIS/7.0 Set-Cookie: market=en-US; domain=secureserver.net;", "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/ P3P: policyref=\"/w3c/p3p.xml\",", "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "X-Powered-By: ARR/2.5 X-Powered-By: ASP.NET P3P: policyref=\"/w3c/p3p.xml\", CP=\"", "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "Date: Tue, 13 Jun 2017 10:21:34 GMT", "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc", "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org", "PDNS11.DOMAINCONTROL.COM", "https://otx.alienvault.com/indicator/domain/secureserver.net", "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf", "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication", "https://den.h5datacenters.com/", "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer", "register.blackgirldroneworld.com (Is this racist)", "https://stetsed.xyz/apple", "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology", "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co", "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD", "Patient/ Victim unaware of her workers compensation rights.", "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!", "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey", "I haven\u2019t mentioned the hit men they hired.", "Fastly.com", "www.skynetsoftware.com", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android®=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox", "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Virus:Win32/Triusor.A", "display_name": "Virus:Win32/Triusor.A", "target": "/malware/Virus:Win32/Triusor.A" }, { "id": "!InstallCreatorPro_2_0", "display_name": "!InstallCreatorPro_2_0", "target": null }, { "id": "Unix.Trojan.Mirai-7640640-0", "display_name": "Unix.Trojan.Mirai-7640640-0", "target": null }, { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Win.Downloader", "display_name": "Win.Downloader", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2817, "domain": 487, "hostname": 983, "FileHash-SHA256": 611, "FileHash-MD5": 107, "FileHash-SHA1": 106, "email": 2 }, "indicator_count": 5113, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "78 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695035a98f01d94b2598f8ee", "name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University", "description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were found. \n\nAll attacks immediately following assault.", "modified": "2026-01-26T18:04:20.395000", "created": "2025-12-27T19:38:17.198000", "tags": [ "united", "unknown aaaa", "accept encoding", "moved", "urls", "files", "encrypt", "passive dns", "all ipv4", "america flag", "america asn", "ransom", "backdoor", "mtb win32", "mirai", "united states", "type indicator", "role title", "container", "ip address", "i div", "h2 p", "h4 p", "data", "desktop", "powerful", "url https", "url http", "indicator role", "active related", "cidr", "types", "indicators show", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "defense evasion", "spawns", "mitre att", "ck matrix", "command decode", "programfiles", "suricata ipv4", "windir", "comspec", "hybrid", "general", "path", "model", "click", "strings", "prometheus", "palantir", "kill list", "tracking", "moon linksys", "router", "emotet", "active", "regis university", "ascii text", "show technique", "pattern match", "sha1", "show process", "root", "local", "development att", "ssl certificate", "extranet", "maven" ], "references": [ "Palantir Extranet -https://prometheusintelligencetechnology.com/", "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more", "IDS Detections: TheMoon.linksys.router", "We don\u2019t know how Octoseek & ScoreBlie (Team8) became part of \u2018No Problems\u2019", "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.", "This is directed to target, communicated where target was enrolled- Regis University Denver , Co", "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC", "Tsara Brashears warned of hack, provided detailed information, provided advice", "\u2018Close enrollment. Get all new devices. Stop using Barracuda.", "Find a way to safely begin from a new server. Work from a Virtual World Class", "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey", "Old staff slow, foolish but eventually heeded instructions / once it was too late", "Dean is deceased? Was the only staff who insisted that Tsara\u2019s tuition be reimbursed", "She was in the botnet already", "Was denied after third enrollment showed false information", "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled", "Bills from nowhere appeared. Again staff said this never happened before left her with the debt.", "Tsara was unable to finish her second degree this way. But found a way.", "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student", "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed", "Many pulses are missing. When we first began using this tool PIT was what we researched first", "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities", "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .", "She refused. Two weeks later man is parked outside of her residence in a different county and city.", "I\u2019m concerned because they are attacking people associated with her and thins needs to stop", "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump", "Lots of detail because someone , somewhere is going through this." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Win32:RansomX-gen\\ [Ransom]", "display_name": "Win32:RansomX-gen\\ [Ransom]", "target": null }, { "id": "ELF:Mirai-AAL\\ [Trj]", "display_name": "ELF:Mirai-AAL\\ [Trj]", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 5, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1037, "domain": 161, "hostname": 340, "email": 2, "FileHash-SHA256": 315, "FileHash-MD5": 14, "FileHash-SHA1": 20, "CIDR": 16, "SSLCertFingerprint": 8 }, "indicator_count": 1913, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "83 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695043197c2fbfda85abc1d4", "name": "Palantir Ad Maven tracking under various names | Espionage Malware &Botnet associated", "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just", "modified": "2025-12-27T20:35:37.012000", "created": "2025-12-27T20:35:37.012000", "tags": [ "Palantir", "Ad- Maven", "Prometheus Intelligence Technology" ], "references": [ "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel", "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Carts.Guru", "display_name": "Carts.Guru", "target": null } ], "attack_ids": [], "industries": [ "Government", "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 82, "hostname": 180, "URL": 995, "FileHash-SHA256": 110 }, "indicator_count": 1367, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "112 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695037a65cf67607c4297e44", "name": "PIT - RU", "description": "name:\nhxxps://prometheusintelligencetechnology.com/pit/fr\name?item=%2Fabout-regis-university%2Fconsumer-i nformation%2Fcertificate-programs%2Fcbe-graduat e%2Fmba-emphasis-organizational-performance-ma nagement&user=extranet%5CAnonymous&site=websi te&id1=75eb8670-c738-48b1-99f4-0779a59c913d&id\n2&idSite=323", "modified": "2025-12-27T19:46:46.701000", "created": "2025-12-27T19:46:46.701000", "tags": [], "references": [ "RegisUniverity.edu", "name: hxxps://prometheusintelligencetechnology.com/pit/fr ame?item=%2Fabout-regis-university%2Fconsumer-i nformation%2Fcertificate-programs%2Fcbe-graduat e%2Fmba-emphasis-organizational-performance-ma nagement&user=extranet%5CAnonymous&site=websi te&id1=75eb8670-c738-48b1-99f4-0779a59c913d&id 2&idSite=323" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FilePath": 1, "URL": 13, "domain": 1, "hostname": 1 }, "indicator_count": 16, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "113 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "687d91b1a8f414040bfba430", "name": "Spyware", "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool", "modified": "2025-08-20T00:01:59.498000", "created": "2025-07-21T01:02:41.049000", "tags": [ "serving ip", "address", "status", "utc na", "utc google", "utc facebook", "custom audience", "tag manager", "ua748443502", "utc gtmwrp73mt", "utc gsrdlm5jnx1", "utc aw937838002", "adsense na", "connect", "file type", "status code", "body length", "kb body", "sha256", "powershell", "b file", "ta0004 defense", "evasion ta0005", "command", "control ta0011", "c0002 wininet", "number", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "corporation cus", "algorithm", "cndigicert sha2", "secure server", "ca odigicert", "inc cus", "subject", "cnwe1 ogoogle", "trust", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft", "get http", "request", "windows nt", "win64", "khtml", "gecko", "response", "united", "search", "creation date", "expiration date", "name servers", "unknown soa", "germany unknown", "entries", "pulse submit", "url analysis", "date" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 304, "hostname": 796, "URL": 2590, "FileHash-SHA256": 2735, "FileHash-MD5": 253, "FileHash-SHA1": 144, "email": 1 }, "indicator_count": 6823, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "242 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "I haven\u2019t mentioned the hit men they hired.", "https://www.secureserver.net/default404.aspx", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t", "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )", "Many pulses are missing. When we first began using this tool PIT was what we researched first", "This is directed to target, communicated where target was enrolled- Regis University Denver , Co", "She refused. Two weeks later man is parked outside of her residence in a different county and city.", "Patient/ Victim unaware of her workers compensation rights.", "https://prometheusintelligencetechnology.com/404javascript.js", "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM", "Was denied after third enrollment showed false information", "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer", "Tsara Brashears warned of hack, provided detailed information, provided advice", "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse", "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc", "name: hxxps://prometheusintelligencetechnology.com/pit/fr ame?item=%2Fabout-regis-university%2Fconsumer-i nformation%2Fcertificate-programs%2Fcbe-graduat e%2Fmba-emphasis-organizational-performance-ma nagement&user=extranet%5CAnonymous&site=websi te&id1=75eb8670-c738-48b1-99f4-0779a59c913d&id 2&idSite=323", "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!", "I\u2019m concerned because they are attacking people associated with her and thins needs to stop", "Powered-By: ARR/2.5 X-Powered-By: ASP.NET", "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/ P3P: policyref=\"/w3c/p3p.xml\",", "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.", "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "http://certs.starfieldtech.com/repository/ 443", "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student", "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net", "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey", "http://crl.starfieldtech.com/sfig2s2-0.crl 443", "\u2018Close enrollment. Get all new devices. Stop using Barracuda.", "Dean is deceased? Was the only staff who insisted that Tsara\u2019s tuition be reimbursed", "A Domains \u2022 www.secureserver.net 443 Certificate", "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "https://otx.alienvault.com/indicator/domain/secureserver.net", "Server: Microsoft-IIS/7.0 Set-Cookie: market=en-US; domain=secureserver.net;", "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump", "https://www.secureserver.net/default404.aspx Server: Microsoft-IIS/7.0", "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443", "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml", "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443", "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org", "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC", "We don\u2019t know how Octoseek & ScoreBlie (Team8) became part of \u2018No Problems\u2019", "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found Content-Length: 161", "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication", "She was in the botnet already", "https://stetsed.xyz/apple", "X-Powered-By: ARR/2.5 X-Powered-By: ASP.NET P3P: policyref=\"/w3c/p3p.xml\", CP=\"", "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443", "Date: Tue, 13 Jun 2017 10:21:34 GMT", "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf", "Lots of detail because someone , somewhere is going through this.", "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found Cache-Control: private", "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed", "Old staff slow, foolish but eventually heeded instructions / once it was too late", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "PDNS11.DOMAINCONTROL.COM", "register.blackgirldroneworld.com (Is this racist)", "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer", "IDS Detections: TheMoon.linksys.router", "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/ P3P:", "https://den.h5datacenters.com/", "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox", "Find a way to safely begin from a new server. Work from a Virtual World Class", "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443", "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers", "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD", "http://ocsp.starfieldtech.com/ 443 Certificate", "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "Tsara was unable to finish her second degree this way. But found a way.", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android®=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t", "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx", "Content-Length: 160 Location: http://www.secureserver.net/default404.aspx", "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel", "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology", "Certificate Crldistributionpoints", "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities", "RegisUniverity.edu", "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM", "https://prometheusintelligencetechnology.com/pit/", "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more", "Fastly.com", "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey", "Palantir Extranet -https://prometheusintelligencetechnology.com/", "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co", "www.skynetsoftware.com", "Bills from nowhere appeared. Again staff said this never happened before left her with the debt." ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Unix.trojan.mirai-7640640-0", "#lowfienabledtcontinueafterunpacking", "Virus:win32/triusor.a", "Win.downloader", "Emotet", "Mirai", "Elf:mirai-aal\\ [trj]", "Win32:ransomx-gen\\ [ransom]", "!installcreatorpro_2_0", "Carts.guru" ], "industries": [ "Education", "Government", "Civil society" ], "unique_indicators": 12978 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/prometheusintelligencetechnology.com", "whois": "http://whois.domaintools.com/prometheusintelligencetechnology.com", "domain": "prometheusintelligencetechnology.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "69560fa62bddc3d965359168", "name": "Mirai H5DATACENTERS.COM \u2022 Regis University Blackout | Extranet", "description": "It was Data Center 5. \nH5DATACENTERS.COM \u2022 Regis University Blackout PrometheusIntelligenceTechnology.com - Extranet. Forced out of RU for finding malicious link that targeted , tracked ,conversations , behavior, etc., \u201cNo one willingly signed up to be tracked.\u201dis what Tsara told Dean Archer. He said he\u2019d never seen anything like this in his life. RU ignored the risks Tsara cautioned could irreparably damage incoming students college experience and negatively impact their future. I just hope the many students who attended do not continue to suffer. Guess who the villain was? The truth teller. \n\nToday activity has stepped up. Somehow the PIT Pulse has caused a crusade of aggressive following and investigation. \n\nThere may be 10,000 vs 1 in this battle. But the One is God.", "modified": "2026-01-31T03:04:09.490000", "created": "2026-01-01T06:09:42.057000", "tags": [ "http", "files related", "related tags", "ipv4", "ccus asnas20029", "urls", "domain", "files ip", "address domain", "ip whois", "passive dns", "gmt path", "hostname add", "files", "united", "a li", "trackingpin a", "ip address", "unknown aaaa", "error", "back", "darkness", "present sep", "a domains", "script urls", "unknown ns", "script domains", "meta", "apache", "body doctype", "gmt server", "url analysis", "path", "accept", "pragma", "west domains", "present dec", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "data upload", "extraction", "found", "datacenter", "hosting", "vps reverse", "america united", "america asn", "as398101", "body html", "head title", "title", "status", "name servers", "failed", "all se", "enter sc", "type", "extra data", "referen", "manualv add", "indicator data", "port", "destination", "south korea", "china as4134", "taiwan as3462", "as3786 lg", "as4766 korea", "as9318 sk", "high", "tcp syn", "trojan", "pegasus", "malware", "unknown", "search", "present jan", "pur sta", "uni idc", "cao oti", "dsp cor", "body", "win32", "united states", "pulse tags", "palantir", "ad maven", "technology", "url https", "url http", "indicator role", "title added", "active related", "Palantir", "Ad-Maven", "Palantir", "Ad- Maven", "Prometheus Intelligence Technology", "skynet", "starfield tech", "flock", "report spam", "palantir ad", "maven", "botnet", "created", "days ago", "education", "tsara", "mirai", "regis", "brashears", "discovery", "universities", "tsara brashears", "close", "stop", "ransom", "capture", "denver" ], "references": [ "H5DATACENTERS.COM Name Servers: NS74.DOMAINCONTROL.COM", "https://prometheusintelligencetechnology.com/pit/", "https://prometheusintelligencetechnology.com/404javascript.js", "https://www.secureserver.net/default404.aspx", "http://ocsp.starfieldtech.com/ 443 Certificate", "https://www.secureserver.net/default404.aspx Server: Microsoft-IIS/7.0", "Set-Cookie: market=en-US; domain=secureserver.net; expires=path=/ P3P:", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "Powered-By: ARR/2.5 X-Powered-By: ASP.NET", "href= here /a . /h2 /body /html 443 Header \u2022 HTTP/1.1 302 Found Content-Length: 161", "Location: policyref=\"/w3c/p3p.xml\", CP=\"COM X-P3P: policyref=\"/w3c/p3p.xml\", CP=\"COM", "\u201cCNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "(Date: Tue, 13 Jun 2017 10:21:34 GMT 443 )", "Certificate Crldistributionpoints", "http://crl.starfieldtech.com/sfig2s2-0.crl 443", "Certificate Subjectaltname\t*.secureserver.net 443 Certificate Subjectaltname\tsecureserver.net", "443 Certificate Notbefore\tAug 25 16:21:59 2014 GMT 443 Certificate Caissuers", "Serialnumber\t27B78B2246C9C1 443 Certificate Notafter \u2022 Aug 25 16:21:59 2017 GMT 443", "Certificate Version 3 443 Certificate Subject\tUS 443 Certificate Subject\tArizona 443", "Certificate Subject Scottsdale 443 Certificate Subject\tSpecial Domain Services, LLC 443", "Certificate Issuer\tStarfield Technologies, Inc. 443 Certificate Issuer", "http://certs.starfieldtech.com/repository/ 443", "Certificate Issuer: Starfield Secure Certificate Authority - G2 443 Title: Object moved 443", "A Domains \u2022 www.secureserver.net 443 Certificate", "Object moved /title /head body h2 Object moved to a href= http://www.secureserver.net/default404.aspx", "80 Body\t here /a . /h2 /body /html 80 Header\tHTTP/1.1 302 Found Cache-Control: private", "Content-Length: 160 Location: http://www.secureserver.net/default404.aspx", "Server: Microsoft-IIS/7.0 Set-Cookie: market=en-US; domain=secureserver.net;", "expires=Wed, 13-Jun-2018 10:21:35 GMT; path=/ P3P: policyref=\"/w3c/p3p.xml\",", "CP=\"COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND\"", "X-Powered-By: ARR/2.5 X-Powered-By: ASP.NET P3P: policyref=\"/w3c/p3p.xml\", CP=\"", "\u201cCOM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND\"", "Date: Tue, 13 Jun 2017 10:21:34 GMT", "Sha1 :e4ca8288d5e4912a00482418765b58a2e22fd5dc", "TrackingPin (Error) A Domains: trackingpin.com \u2022 Domains: forum.trackingpin.org", "PDNS11.DOMAINCONTROL.COM", "https://otx.alienvault.com/indicator/domain/secureserver.net", "Unix.TrojanMirai-7640640-0 IDS Detections Bad Login root login Yara Detections is__elf", "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication", "https://den.h5datacenters.com/", "http://prometheusintelligencetechnology.com/pitframeitem=22fsbout-regis-univer", "register.blackgirldroneworld.com (Is this racist)", "https://stetsed.xyz/apple", "Palantir Ad-Maven Palantir, Ad- Maven, Prometheus Intelligence Technology", "Review: Jeffrey Reimer DPT assaulted & egregiously injured a patient at AMS Concentra in Denver, Co", "It\u2019s was sexual and violent. Patient was under the oversight of Mark Montano MD and John T. Sacha MD", "Patient/ Victim unaware of her workers compensation rights.", "Do you line how they spend your tax dollars? Attacking victims? Protecting Corporations!", "Quasi Government, Meta, Twitter , Palantir , Gotham , Christopher P. Ahmann , Brian Sabey", "I haven\u2019t mentioned the hit men they hired.", "Fastly.com", "www.skynetsoftware.com", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroid&ver=1.999&key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&platform=Android®=&devId=92841014150fc3fd&devInfo=&devEmail=&width=480&height=764&owner=19&model=Lenovo A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=2.800&key=2w6i4y1r0sdz6q9gchjcpkal0oaiem4u8ncy3bct1vcr8e6x2w&platform=Android&devId=92841014150fc3fd&width=480&height=764&owner=19&model=Lenovo%20A360t", "http://www.skynetsoftware.com/SNSAuth/appauth.aspx?app=myPlayerDroidPro&ver=3.700&key=53dbnf9wrz8vc0m5xfve2q1w2r4x8fv0g1b8sfg7qi0rdxck2j&platform=Android&devId=dc9c9a616665e073&width=800&height=561&owner=19&model=VirtualBox", "http://www.skynetsoftware.com/myPlayer/myPlayerDroid.xml" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Virus:Win32/Triusor.A", "display_name": "Virus:Win32/Triusor.A", "target": "/malware/Virus:Win32/Triusor.A" }, { "id": "!InstallCreatorPro_2_0", "display_name": "!InstallCreatorPro_2_0", "target": null }, { "id": "Unix.Trojan.Mirai-7640640-0", "display_name": "Unix.Trojan.Mirai-7640640-0", "target": null }, { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Win.Downloader", "display_name": "Win.Downloader", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2817, "domain": 487, "hostname": 983, "FileHash-SHA256": 611, "FileHash-MD5": 107, "FileHash-SHA1": 106, "email": 2 }, "indicator_count": 5113, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "78 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695035a98f01d94b2598f8ee", "name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University", "description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were found. \n\nAll attacks immediately following assault.", "modified": "2026-01-26T18:04:20.395000", "created": "2025-12-27T19:38:17.198000", "tags": [ "united", "unknown aaaa", "accept encoding", "moved", "urls", "files", "encrypt", "passive dns", "all ipv4", "america flag", "america asn", "ransom", "backdoor", "mtb win32", "mirai", "united states", "type indicator", "role title", "container", "ip address", "i div", "h2 p", "h4 p", "data", "desktop", "powerful", "url https", "url http", "indicator role", "active related", "cidr", "types", "indicators show", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "defense evasion", "spawns", "mitre att", "ck matrix", "command decode", "programfiles", "suricata ipv4", "windir", "comspec", "hybrid", "general", "path", "model", "click", "strings", "prometheus", "palantir", "kill list", "tracking", "moon linksys", "router", "emotet", "active", "regis university", "ascii text", "show technique", "pattern match", "sha1", "show process", "root", "local", "development att", "ssl certificate", "extranet", "maven" ], "references": [ "Palantir Extranet -https://prometheusintelligencetechnology.com/", "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more", "IDS Detections: TheMoon.linksys.router", "We don\u2019t know how Octoseek & ScoreBlie (Team8) became part of \u2018No Problems\u2019", "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.", "This is directed to target, communicated where target was enrolled- Regis University Denver , Co", "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC", "Tsara Brashears warned of hack, provided detailed information, provided advice", "\u2018Close enrollment. Get all new devices. Stop using Barracuda.", "Find a way to safely begin from a new server. Work from a Virtual World Class", "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey", "Old staff slow, foolish but eventually heeded instructions / once it was too late", "Dean is deceased? Was the only staff who insisted that Tsara\u2019s tuition be reimbursed", "She was in the botnet already", "Was denied after third enrollment showed false information", "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled", "Bills from nowhere appeared. Again staff said this never happened before left her with the debt.", "Tsara was unable to finish her second degree this way. But found a way.", "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student", "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed", "Many pulses are missing. When we first began using this tool PIT was what we researched first", "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities", "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .", "She refused. Two weeks later man is parked outside of her residence in a different county and city.", "I\u2019m concerned because they are attacking people associated with her and thins needs to stop", "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump", "Lots of detail because someone , somewhere is going through this." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Win32:RansomX-gen\\ [Ransom]", "display_name": "Win32:RansomX-gen\\ [Ransom]", "target": null }, { "id": "ELF:Mirai-AAL\\ [Trj]", "display_name": "ELF:Mirai-AAL\\ [Trj]", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 5, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1037, "domain": 161, "hostname": 340, "email": 2, "FileHash-SHA256": 315, "FileHash-MD5": 14, "FileHash-SHA1": 20, "CIDR": 16, "SSLCertFingerprint": 8 }, "indicator_count": 1913, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "83 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695043197c2fbfda85abc1d4", "name": "Palantir Ad Maven tracking under various names | Espionage Malware &Botnet associated", "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just", "modified": "2025-12-27T20:35:37.012000", "created": "2025-12-27T20:35:37.012000", "tags": [ "Palantir", "Ad- Maven", "Prometheus Intelligence Technology" ], "references": [ "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel", "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Carts.Guru", "display_name": "Carts.Guru", "target": null } ], "attack_ids": [], "industries": [ "Government", "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 82, "hostname": 180, "URL": 995, "FileHash-SHA256": 110 }, "indicator_count": 1367, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "112 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "695037a65cf67607c4297e44", "name": "PIT - RU", "description": "name:\nhxxps://prometheusintelligencetechnology.com/pit/fr\name?item=%2Fabout-regis-university%2Fconsumer-i nformation%2Fcertificate-programs%2Fcbe-graduat e%2Fmba-emphasis-organizational-performance-ma nagement&user=extranet%5CAnonymous&site=websi te&id1=75eb8670-c738-48b1-99f4-0779a59c913d&id\n2&idSite=323", "modified": "2025-12-27T19:46:46.701000", "created": "2025-12-27T19:46:46.701000", "tags": [], "references": [ "RegisUniverity.edu", "name: hxxps://prometheusintelligencetechnology.com/pit/fr ame?item=%2Fabout-regis-university%2Fconsumer-i nformation%2Fcertificate-programs%2Fcbe-graduat e%2Fmba-emphasis-organizational-performance-ma nagement&user=extranet%5CAnonymous&site=websi te&id1=75eb8670-c738-48b1-99f4-0779a59c913d&id 2&idSite=323" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FilePath": 1, "URL": 13, "domain": 1, "hostname": 1 }, "indicator_count": 16, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "113 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "687d91b1a8f414040bfba430", "name": "Spyware", "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool", "modified": "2025-08-20T00:01:59.498000", "created": "2025-07-21T01:02:41.049000", "tags": [ "serving ip", "address", "status", "utc na", "utc google", "utc facebook", "custom audience", "tag manager", "ua748443502", "utc gtmwrp73mt", "utc gsrdlm5jnx1", "utc aw937838002", "adsense na", "connect", "file type", "status code", "body length", "kb body", "sha256", "powershell", "b file", "ta0004 defense", "evasion ta0005", "command", "control ta0011", "c0002 wininet", "number", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "corporation cus", "algorithm", "cndigicert sha2", "secure server", "ca odigicert", "inc cus", "subject", "cnwe1 ogoogle", "trust", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft", "get http", "request", "windows nt", "win64", "khtml", "gecko", "response", "united", "search", "creation date", "expiration date", "name servers", "unknown soa", "germany unknown", "entries", "pulse submit", "url analysis", "date" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 304, "hostname": 796, "URL": 2590, "FileHash-SHA256": 2735, "FileHash-MD5": 253, "FileHash-SHA1": 144, "email": 1 }, "indicator_count": 6823, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "242 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://prometheusintelligencetechnology.com/404javascript.js", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://prometheusintelligencetechnology.com/404javascript.js", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776629664.7739098 }