{
  "type": "URL",
  "indicator": "https://ray.ns.cloudfare.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ray.ns.cloudfare.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3762497775,
      "indicator": "https://ray.ns.cloudfare.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 15,
      "pulses": [
        {
          "id": "657fee4dec993692315eb9e9",
          "name": "NjRAT | Threat Network | https://www.poemhunter.com/tsara-brashears  ",
          "description": "",
          "modified": "2024-09-05T07:13:57.083000",
          "created": "2023-12-18T07:01:33.682000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657fed19f6d24e751fa82de8",
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2775,
            "URL": 7125,
            "domain": 1726,
            "hostname": 2417
          },
          "indicator_count": 14348,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fbac7f0d96f1ad5d90ccb",
          "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
          "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T03:21:43.483000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fbac9a03d611624985685",
          "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
          "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T03:21:45.890000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fed19f6d24e751fa82de8",
          "name": "Lazarus Hosts | https://www.poemhunter.com/tsara-brashears",
          "description": "",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T06:56:25.399000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657fbac9a03d611624985685",
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655f6d7ac217661e4bc37f4d",
          "name": "Qbot | Miscellaneous Attacks",
          "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
          "modified": "2023-12-23T07:03:55.171000",
          "created": "2023-11-23T15:19:22.356000",
          "tags": [
            "pattern match",
            "ascii text",
            "file",
            "jpeg image",
            "exif standard",
            "tiff image",
            "png image",
            "united",
            "baseline",
            "rgba",
            "date",
            "class",
            "unknown",
            "hybrid",
            "accept",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "error",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "botnet command",
            "control server",
            "noname057",
            "facebook",
            "phishtank",
            "blacklist http",
            "organization",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "n64xtx0vpihxzc",
            "whois whois",
            "qpyrn6pd http",
            "referrer",
            "execution",
            "communicating",
            "core",
            "discord",
            "hiddentear",
            "metro",
            "probe",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bleachgap",
            "formbook",
            "nanocore",
            "roblox",
            "heur",
            "cyber threat",
            "engineering",
            "malware",
            "phishing",
            "malicious site",
            "phishing site",
            "covid19",
            "team",
            "bank",
            "cobalt strike",
            "artemis",
            "download",
            "zbot",
            "suppobox",
            "service",
            "downloader",
            "virut",
            "malicious",
            "emotet",
            "stealer",
            "exploit",
            "generic",
            "dropper",
            "unruy",
            "agent",
            "unsafe",
            "ramnit",
            "redline stealer",
            "smsspy",
            "bradesco",
            "fakealert",
            "qakbot",
            "outbreak",
            "qbot",
            "bankerx",
            "riskware",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "squirrelwaffle",
            "pony",
            "binder",
            "virustotal",
            "azorult",
            "zeus",
            "nymaim",
            "matsnu",
            "simda",
            "runescape",
            "cutwail",
            "dnspionage",
            "redirector",
            "fusioncore",
            "iframe",
            "killav",
            "raccoon",
            "daum",
            "installcore",
            "ransomware",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "presenoker",
            "downldr",
            "alexa",
            "applicunwnt",
            "opencandy",
            "cleaner",
            "wacatac",
            "xrat",
            "xtrat",
            "dbatloader",
            "infy",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "phish",
            "deepscan",
            "trojanspy",
            "maltiverse",
            "qpyrn6pd",
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
            "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
            "*otc.greatcall.com    [Botnetwork]",
            "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
            "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
            "tulach.cc.     [Malevolent | Modified description]",
            "https://tulach.cc/ [phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
            "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
            "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
          ],
          "public": 1,
          "adversary": "Qbot",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 897,
            "FileHash-SHA1": 479,
            "URL": 9847,
            "domain": 2344,
            "hostname": 2398,
            "CVE": 22,
            "FileHash-SHA256": 4712
          },
          "indicator_count": 20699,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "848 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655f6d89b33758a190399f39",
          "name": "Qbot | Miscellaneous Attacks",
          "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
          "modified": "2023-12-23T07:03:55.171000",
          "created": "2023-11-23T15:19:37.838000",
          "tags": [
            "pattern match",
            "ascii text",
            "file",
            "jpeg image",
            "exif standard",
            "tiff image",
            "png image",
            "united",
            "baseline",
            "rgba",
            "date",
            "class",
            "unknown",
            "hybrid",
            "accept",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "error",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "botnet command",
            "control server",
            "noname057",
            "facebook",
            "phishtank",
            "blacklist http",
            "organization",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "n64xtx0vpihxzc",
            "whois whois",
            "qpyrn6pd http",
            "referrer",
            "execution",
            "communicating",
            "core",
            "discord",
            "hiddentear",
            "metro",
            "probe",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bleachgap",
            "formbook",
            "nanocore",
            "roblox",
            "heur",
            "cyber threat",
            "engineering",
            "malware",
            "phishing",
            "malicious site",
            "phishing site",
            "covid19",
            "team",
            "bank",
            "cobalt strike",
            "artemis",
            "download",
            "zbot",
            "suppobox",
            "service",
            "downloader",
            "virut",
            "malicious",
            "emotet",
            "stealer",
            "exploit",
            "generic",
            "dropper",
            "unruy",
            "agent",
            "unsafe",
            "ramnit",
            "redline stealer",
            "smsspy",
            "bradesco",
            "fakealert",
            "qakbot",
            "outbreak",
            "qbot",
            "bankerx",
            "riskware",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "squirrelwaffle",
            "pony",
            "binder",
            "virustotal",
            "azorult",
            "zeus",
            "nymaim",
            "matsnu",
            "simda",
            "runescape",
            "cutwail",
            "dnspionage",
            "redirector",
            "fusioncore",
            "iframe",
            "killav",
            "raccoon",
            "daum",
            "installcore",
            "ransomware",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "presenoker",
            "downldr",
            "alexa",
            "applicunwnt",
            "opencandy",
            "cleaner",
            "wacatac",
            "xrat",
            "xtrat",
            "dbatloader",
            "infy",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "phish",
            "deepscan",
            "trojanspy",
            "maltiverse",
            "qpyrn6pd",
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
            "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
            "*otc.greatcall.com    [Botnetwork]",
            "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
            "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
            "tulach.cc.     [Malevolent | Modified description]",
            "https://tulach.cc/ [phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
            "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
            "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
          ],
          "public": 1,
          "adversary": "Qbot",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 84,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 897,
            "FileHash-SHA1": 479,
            "URL": 9847,
            "domain": 2344,
            "hostname": 2398,
            "CVE": 22,
            "FileHash-SHA256": 4712
          },
          "indicator_count": 20699,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "848 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655f6edffd3910161c2ad1a2",
          "name": "D26A | DNSpionage| Qbot | Tulach Malaware | https://theanimallawfirm.com/ | FakeAlert",
          "description": "",
          "modified": "2023-12-23T07:03:55.171000",
          "created": "2023-11-23T15:25:19.843000",
          "tags": [
            "pattern match",
            "ascii text",
            "file",
            "jpeg image",
            "exif standard",
            "tiff image",
            "png image",
            "united",
            "baseline",
            "rgba",
            "date",
            "class",
            "unknown",
            "hybrid",
            "accept",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "error",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "botnet command",
            "control server",
            "noname057",
            "facebook",
            "phishtank",
            "blacklist http",
            "organization",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "n64xtx0vpihxzc",
            "whois whois",
            "qpyrn6pd http",
            "referrer",
            "execution",
            "communicating",
            "core",
            "discord",
            "hiddentear",
            "metro",
            "probe",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bleachgap",
            "formbook",
            "nanocore",
            "roblox",
            "heur",
            "cyber threat",
            "engineering",
            "malware",
            "phishing",
            "malicious site",
            "phishing site",
            "covid19",
            "team",
            "bank",
            "cobalt strike",
            "artemis",
            "download",
            "zbot",
            "suppobox",
            "service",
            "downloader",
            "virut",
            "malicious",
            "emotet",
            "stealer",
            "exploit",
            "generic",
            "dropper",
            "unruy",
            "agent",
            "unsafe",
            "ramnit",
            "redline stealer",
            "smsspy",
            "bradesco",
            "fakealert",
            "qakbot",
            "outbreak",
            "qbot",
            "bankerx",
            "riskware",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "squirrelwaffle",
            "pony",
            "binder",
            "virustotal",
            "azorult",
            "zeus",
            "nymaim",
            "matsnu",
            "simda",
            "runescape",
            "cutwail",
            "dnspionage",
            "redirector",
            "fusioncore",
            "iframe",
            "killav",
            "raccoon",
            "daum",
            "installcore",
            "ransomware",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "presenoker",
            "downldr",
            "alexa",
            "applicunwnt",
            "opencandy",
            "cleaner",
            "wacatac",
            "xrat",
            "xtrat",
            "dbatloader",
            "infy",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "phish",
            "deepscan",
            "trojanspy",
            "maltiverse",
            "qpyrn6pd",
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
            "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
            "*otc.greatcall.com    [Botnetwork]",
            "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
            "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
            "tulach.cc.     [Malevolent | Modified description]",
            "https://tulach.cc/ [phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
            "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
            "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
          ],
          "public": 1,
          "adversary": "Qbot",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "655f6d89b33758a190399f39",
          "export_count": 86,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 897,
            "FileHash-SHA1": 479,
            "URL": 9847,
            "domain": 2344,
            "hostname": 2398,
            "CVE": 22,
            "FileHash-SHA256": 4712
          },
          "indicator_count": 20699,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "848 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8bf416a1c314819ea53",
          "name": "Remote Access Related |  APK attack targets independent artists",
          "description": "",
          "modified": "2023-12-06T17:00:47.888000",
          "created": "2023-12-06T17:00:47.888000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 5,
            "FileHash-SHA256": 2385,
            "hostname": 1054,
            "domain": 713,
            "URL": 3595,
            "FileHash-MD5": 1104,
            "FileHash-SHA1": 585,
            "FilePath": 1
          },
          "indicator_count": 9442,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a79534c615a8f10f3380",
          "name": "Qakbot | Info Stealer | Sourced:  Part-RU",
          "description": "",
          "modified": "2023-12-06T16:55:49.669000",
          "created": "2023-12-06T16:55:49.669000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2383,
            "hostname": 1027,
            "domain": 418,
            "URL": 2673,
            "FileHash-MD5": 99,
            "FileHash-SHA1": 98
          },
          "indicator_count": 6698,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 112,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6533ed2685e0fc66ac0628bd",
          "name": "Network capture | Gather Victim Network Information | C2",
          "description": "Botnet. Spammer. BN campaigners. Victim name used for marketing BN and porn. This website contains age-restricted material and contains explicit depictions of sexual activity, but does not ask for permission to access or access any of the site's materials. \u00c2\u00a9 Mile High Distribution Inc",
          "modified": "2023-11-20T11:03:09.867000",
          "created": "2023-10-21T15:24:22.377000",
          "tags": [
            "mile high",
            "logos",
            "trademarks",
            "aylo premium",
            "click",
            "record keeping",
            "statement",
            "all rights",
            "reserved",
            "vendo",
            "ssl certificate",
            "contacted",
            "whois record",
            "tsara brashears",
            "historical ssl",
            "apple",
            "password",
            "porn",
            "networks",
            "botnet campaign",
            "crypto",
            "installer",
            "attacker",
            "metro",
            "brazzers",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "maxage86400",
            "path",
            "html info",
            "title page",
            "found meta",
            "milehigh",
            "watch",
            "milfs",
            "trackers google",
            "analytics na",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "specific",
            "pattern match",
            "file",
            "ascii text",
            "windows nt",
            "jpeg image",
            "united",
            "appdata",
            "jfif",
            "mitre att",
            "date",
            "unknown",
            "hybrid",
            "accept",
            "general",
            "local",
            "strings",
            "class",
            "critical",
            "error",
            "server",
            "email",
            "code",
            "whois privacy",
            "domain status",
            "registrar abuse",
            "registrar url",
            "registrar",
            "registry domain",
            "C2",
            "organization",
            "threat level",
            "windir",
            "getpost",
            "name server",
            "openurl c"
          ],
          "references": [
            "https://www.milehighmedia.com/legal/2257                                     exploit_source  [Metro T-Mobile attacker. Brazzers  | T]",
            "https://www.sweetheartvideo.com/tsara-brashears/                    [Botnet tracking campaign, referrer]",
            "https://www.sweetheartvideo.com/tsara-brashears                      [Network ID]",
            "https://www.sweetheartvideo.com                                                       [Pattern match, Brashears]",
            "m1.sweetheartvideo.com                                                                            [mailer!]",
            "mba3.sweetheartvideo.com                                                                       [Server]",
            "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e           [Research Tool]",
            "Other",
            "browser.events.data.msn.com                                                                    [sandbox and archive browser events]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.004",
              "name": "Server",
              "display_name": "T1583.004 - Server"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4377,
            "FileHash-MD5": 128,
            "FileHash-SHA1": 127,
            "FileHash-SHA256": 2861,
            "domain": 829,
            "hostname": 1452,
            "CVE": 1,
            "email": 6
          },
          "indicator_count": 9781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "881 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1d4a989642696d13b34c",
          "name": "Network capture | Gather Victim Network Information | C2",
          "description": "",
          "modified": "2023-11-20T11:03:09.867000",
          "created": "2023-10-30T03:04:42.175000",
          "tags": [
            "mile high",
            "logos",
            "trademarks",
            "aylo premium",
            "click",
            "record keeping",
            "statement",
            "all rights",
            "reserved",
            "vendo",
            "ssl certificate",
            "contacted",
            "whois record",
            "tsara brashears",
            "historical ssl",
            "apple",
            "password",
            "porn",
            "networks",
            "botnet campaign",
            "crypto",
            "installer",
            "attacker",
            "metro",
            "brazzers",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "maxage86400",
            "path",
            "html info",
            "title page",
            "found meta",
            "milehigh",
            "watch",
            "milfs",
            "trackers google",
            "analytics na",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "specific",
            "pattern match",
            "file",
            "ascii text",
            "windows nt",
            "jpeg image",
            "united",
            "appdata",
            "jfif",
            "mitre att",
            "date",
            "unknown",
            "hybrid",
            "accept",
            "general",
            "local",
            "strings",
            "class",
            "critical",
            "error",
            "server",
            "email",
            "code",
            "whois privacy",
            "domain status",
            "registrar abuse",
            "registrar url",
            "registrar",
            "registry domain",
            "C2",
            "organization",
            "threat level",
            "windir",
            "getpost",
            "name server",
            "openurl c"
          ],
          "references": [
            "https://www.milehighmedia.com/legal/2257                                     exploit_source  [Metro T-Mobile attacker. Brazzers  | T]",
            "https://www.sweetheartvideo.com/tsara-brashears/                    [Botnet tracking campaign, referrer]",
            "https://www.sweetheartvideo.com/tsara-brashears                      [Network ID]",
            "https://www.sweetheartvideo.com                                                       [Pattern match, Brashears]",
            "m1.sweetheartvideo.com                                                                            [mailer!]",
            "mba3.sweetheartvideo.com                                                                       [Server]",
            "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e           [Research Tool]",
            "Other",
            "browser.events.data.msn.com                                                                    [sandbox and archive browser events]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.004",
              "name": "Server",
              "display_name": "T1583.004 - Server"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6533ed2685e0fc66ac0628bd",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4377,
            "FileHash-MD5": 128,
            "FileHash-SHA1": 127,
            "FileHash-SHA256": 2861,
            "domain": 829,
            "hostname": 1452,
            "CVE": 1,
            "email": 6
          },
          "indicator_count": 9781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "881 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6528fa2179cc1554d7f434c6",
          "name": "Remote Access Related |  APK attack targets independent artists",
          "description": "Suppression, malware,\nPassword,Exploit/Shellcode *Defacement *Unsafe.AI_Score_ * FileRepMetagen [PUP]\nrevenge-rat,stealer,, Steganos Software GmbH Privacy Suite, Ransom_WannaCrypt.R002C0DJO20,\nWacatac.B, Trojan.HideLink, SuppoBox,Trojan.Downloader.Generic, TrojWare.JS.Obfuscated, Phish.HHH, Phishing_Netflix.EVT, Phishing.Microsoft,Trojan.AvsHepter, HTML:PhishingBank, Phishing.fz, Probably, Heur.HTMLUnescapeF, BehavesLike.HTML.SMSSendPhishing.S23, Gen:Variant.Zbot, BehavesLike.HTML.Faceliker",
          "modified": "2023-11-12T07:01:14.580000",
          "created": "2023-10-13T08:04:49.722000",
          "tags": [
            "alexa top",
            "blacklist",
            "phishing",
            "million",
            "site",
            "cisco umbrella",
            "path",
            "maxage31536000",
            "expiressat",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "pragma",
            "html info",
            "title kedence",
            "official apk",
            "meta tags",
            "apk download",
            "android",
            "google tag",
            "utc google",
            "utc na",
            "whois record",
            "contacted",
            "ssl certificate",
            "communicating",
            "referrer",
            "historical ssl",
            "bundled",
            "resolutions",
            "contacted urls",
            "hackers install",
            "malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "united",
            "phishing site",
            "malware site",
            "malicious site",
            "heur",
            "anonymizer",
            "malicious host",
            "crack",
            "maltiverse",
            "driverpack",
            "ransomware",
            "opencandy",
            "artemis",
            "riskware",
            "installcore",
            "suppobox",
            "bank",
            "agent",
            "patcher",
            "generic",
            "t",
            "safe site",
            "iframe",
            "downldr",
            "presenoker",
            "exploit",
            "genkryptik",
            "dropper",
            "fakealert",
            "quasar rat",
            "xtrat",
            "softcnapp",
            "cleaner",
            "xrat",
            "applicunwnt",
            "mimikatz",
            "team",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "logo analysis",
            "size81b type",
            "mime",
            "scan10132023",
            "results",
            "multi scan",
            "analysis",
            "update",
            "view details",
            "na visit",
            "sansx22",
            "3px 3px",
            "indicator",
            "file",
            "general",
            "email address",
            "pattern match",
            "ck id",
            "t1114",
            "show technique",
            "mitre att",
            "ck matrix",
            "script",
            "antivirus",
            "svg scalable",
            "vector graphics",
            "span",
            "twitter",
            "hybrid",
            "ascii text",
            "appdata",
            "windows nt",
            "png image",
            "jpeg image",
            "jfif",
            "date",
            "flag",
            "markmonitor",
            "name server",
            "server",
            "enom",
            "whois privacy",
            "cloudflare",
            "domain address",
            "show",
            "osint",
            "f8f9fa",
            "eeeeee",
            "click",
            "unknown",
            "open",
            "error",
            "body",
            "hosts",
            "strings",
            "class",
            "critical",
            "meta",
            "scroll",
            "atom"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "T",
              "display_name": "T",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 713,
            "FileHash-MD5": 1104,
            "FileHash-SHA1": 585,
            "FileHash-SHA256": 2385,
            "hostname": 1054,
            "URL": 3596,
            "CVE": 5,
            "FilePath": 1
          },
          "indicator_count": 9443,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "889 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1d23d050527b7aa07cfd",
          "name": "Remote Access Related | APK attack targets independent artists",
          "description": "",
          "modified": "2023-11-12T07:01:14.580000",
          "created": "2023-10-30T03:04:03.323000",
          "tags": [
            "alexa top",
            "blacklist",
            "phishing",
            "million",
            "site",
            "cisco umbrella",
            "path",
            "maxage31536000",
            "expiressat",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "pragma",
            "html info",
            "title kedence",
            "official apk",
            "meta tags",
            "apk download",
            "android",
            "google tag",
            "utc google",
            "utc na",
            "whois record",
            "contacted",
            "ssl certificate",
            "communicating",
            "referrer",
            "historical ssl",
            "bundled",
            "resolutions",
            "contacted urls",
            "hackers install",
            "malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "united",
            "phishing site",
            "malware site",
            "malicious site",
            "heur",
            "anonymizer",
            "malicious host",
            "crack",
            "maltiverse",
            "driverpack",
            "ransomware",
            "opencandy",
            "artemis",
            "riskware",
            "installcore",
            "suppobox",
            "bank",
            "agent",
            "patcher",
            "generic",
            "t",
            "safe site",
            "iframe",
            "downldr",
            "presenoker",
            "exploit",
            "genkryptik",
            "dropper",
            "fakealert",
            "quasar rat",
            "xtrat",
            "softcnapp",
            "cleaner",
            "xrat",
            "applicunwnt",
            "mimikatz",
            "team",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "logo analysis",
            "size81b type",
            "mime",
            "scan10132023",
            "results",
            "multi scan",
            "analysis",
            "update",
            "view details",
            "na visit",
            "sansx22",
            "3px 3px",
            "indicator",
            "file",
            "general",
            "email address",
            "pattern match",
            "ck id",
            "t1114",
            "show technique",
            "mitre att",
            "ck matrix",
            "script",
            "antivirus",
            "svg scalable",
            "vector graphics",
            "span",
            "twitter",
            "hybrid",
            "ascii text",
            "appdata",
            "windows nt",
            "png image",
            "jpeg image",
            "jfif",
            "date",
            "flag",
            "markmonitor",
            "name server",
            "server",
            "enom",
            "whois privacy",
            "cloudflare",
            "domain address",
            "show",
            "osint",
            "f8f9fa",
            "eeeeee",
            "click",
            "unknown",
            "open",
            "error",
            "body",
            "hosts",
            "strings",
            "class",
            "critical",
            "meta",
            "scroll",
            "atom"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "T",
              "display_name": "T",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6528fa2179cc1554d7f434c6",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 713,
            "FileHash-MD5": 1104,
            "FileHash-SHA1": 585,
            "FileHash-SHA256": 2385,
            "hostname": 1054,
            "URL": 3596,
            "CVE": 5,
            "FilePath": 1
          },
          "indicator_count": 9443,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "889 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6519c4b76612eda702942ad6",
          "name": "Qakbot | Info Stealer | Sourced:  Part-RU",
          "description": "Info Stealer\nET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 789",
          "modified": "2023-10-31T16:03:29.760000",
          "created": "2023-10-01T19:12:55.573000",
          "tags": [
            "ssl certificate",
            "contacted",
            "whois record",
            "execution",
            "bundled",
            "resolutions",
            "referrer",
            "communicating",
            "network",
            "historical ssl",
            "malware",
            "twitter",
            "hacktool",
            "june"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 99,
            "FileHash-SHA1": 98,
            "FileHash-SHA256": 2383,
            "URL": 2673,
            "domain": 418,
            "hostname": 1027
          },
          "indicator_count": 6698,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "901 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1344cd54f3a86745a617",
          "name": "Qakbot | Info Stealer | Sourced: Part-RU",
          "description": "",
          "modified": "2023-10-31T16:03:29.760000",
          "created": "2023-10-30T02:21:56.497000",
          "tags": [
            "ssl certificate",
            "contacted",
            "whois record",
            "execution",
            "bundled",
            "resolutions",
            "referrer",
            "communicating",
            "network",
            "historical ssl",
            "malware",
            "twitter",
            "hacktool",
            "june"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6519c4b76612eda702942ad6",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 99,
            "FileHash-SHA1": 98,
            "FileHash-SHA256": 2383,
            "URL": 2673,
            "domain": 418,
            "hostname": 1027
          },
          "indicator_count": 6698,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "901 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "browser.events.data.msn.com                                                                    [sandbox and archive browser events]",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "https://www.sweetheartvideo.com/tsara-brashears                      [Network ID]",
        "https://www.sweetheartvideo.com/tsara-brashears/                    [Botnet tracking campaign, referrer]",
        "https://tulach.cc/ [phishing]",
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "https://www.sweetheartvideo.com                                                       [Pattern match, Brashears]",
        "m1.sweetheartvideo.com                                                                            [mailer!]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "Other",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "*otc.greatcall.com    [Botnetwork]",
        "tulach.cc.     [Malevolent | Modified description]",
        "https://www.milehighmedia.com/legal/2257                                     exploit_source  [Metro T-Mobile attacker. Brazzers  | T]",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]",
        "mba3.sweetheartvideo.com                                                                       [Server]",
        "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e           [Research Tool]",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Qbot"
          ],
          "malware_families": [
            "T",
            "Roblox",
            "Tulach malware",
            "Trojanspy",
            "Maltiverse"
          ],
          "industries": [],
          "unique_indicators": 58022
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/cloudfare.com",
    "whois": "http://whois.domaintools.com/cloudfare.com",
    "domain": "cloudfare.com",
    "hostname": "ray.ns.cloudfare.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 15,
  "pulses": [
    {
      "id": "657fee4dec993692315eb9e9",
      "name": "NjRAT | Threat Network | https://www.poemhunter.com/tsara-brashears  ",
      "description": "",
      "modified": "2024-09-05T07:13:57.083000",
      "created": "2023-12-18T07:01:33.682000",
      "tags": [
        "ssl certificate",
        "whois record",
        "resolutions",
        "threat roundup",
        "referrer",
        "contacted",
        "april",
        "historical ssl",
        "threat network",
        "june",
        "august",
        "ransomware",
        "malware",
        "python",
        "probe",
        "formbook",
        "dropped",
        "njrat",
        "malware alibaba",
        "cloud computing",
        "service",
        "love",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "657fed19f6d24e751fa82de8",
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 152,
        "FileHash-SHA256": 2775,
        "URL": 7125,
        "domain": 1726,
        "hostname": 2417
      },
      "indicator_count": 14348,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657fbac7f0d96f1ad5d90ccb",
      "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
      "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
      "modified": "2024-01-17T01:04:01.912000",
      "created": "2023-12-18T03:21:43.483000",
      "tags": [
        "ssl certificate",
        "whois record",
        "resolutions",
        "threat roundup",
        "referrer",
        "contacted",
        "april",
        "historical ssl",
        "threat network",
        "june",
        "august",
        "ransomware",
        "malware",
        "python",
        "probe",
        "formbook",
        "dropped",
        "njrat",
        "malware alibaba",
        "cloud computing",
        "service",
        "love",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 152,
        "FileHash-SHA256": 2657,
        "URL": 6244,
        "domain": 1672,
        "hostname": 2213
      },
      "indicator_count": 13091,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "823 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657fbac9a03d611624985685",
      "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
      "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
      "modified": "2024-01-17T01:04:01.912000",
      "created": "2023-12-18T03:21:45.890000",
      "tags": [
        "ssl certificate",
        "whois record",
        "resolutions",
        "threat roundup",
        "referrer",
        "contacted",
        "april",
        "historical ssl",
        "threat network",
        "june",
        "august",
        "ransomware",
        "malware",
        "python",
        "probe",
        "formbook",
        "dropped",
        "njrat",
        "malware alibaba",
        "cloud computing",
        "service",
        "love",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 152,
        "FileHash-SHA256": 2657,
        "URL": 6244,
        "domain": 1672,
        "hostname": 2213
      },
      "indicator_count": 13091,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "823 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657fed19f6d24e751fa82de8",
      "name": "Lazarus Hosts | https://www.poemhunter.com/tsara-brashears",
      "description": "",
      "modified": "2024-01-17T01:04:01.912000",
      "created": "2023-12-18T06:56:25.399000",
      "tags": [
        "ssl certificate",
        "whois record",
        "resolutions",
        "threat roundup",
        "referrer",
        "contacted",
        "april",
        "historical ssl",
        "threat network",
        "june",
        "august",
        "ransomware",
        "malware",
        "python",
        "probe",
        "formbook",
        "dropped",
        "njrat",
        "malware alibaba",
        "cloud computing",
        "service",
        "love",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "657fbac9a03d611624985685",
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 152,
        "FileHash-SHA256": 2657,
        "URL": 6244,
        "domain": 1672,
        "hostname": 2213
      },
      "indicator_count": 13091,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "823 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655f6d7ac217661e4bc37f4d",
      "name": "Qbot | Miscellaneous Attacks",
      "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
      "modified": "2023-12-23T07:03:55.171000",
      "created": "2023-11-23T15:19:22.356000",
      "tags": [
        "pattern match",
        "ascii text",
        "file",
        "jpeg image",
        "exif standard",
        "tiff image",
        "png image",
        "united",
        "baseline",
        "rgba",
        "date",
        "class",
        "unknown",
        "hybrid",
        "accept",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "error",
        "firehol",
        "detection list",
        "ip address",
        "blacklist",
        "botnet command",
        "control server",
        "noname057",
        "facebook",
        "phishtank",
        "blacklist http",
        "organization",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "n64xtx0vpihxzc",
        "whois whois",
        "qpyrn6pd http",
        "referrer",
        "execution",
        "communicating",
        "core",
        "discord",
        "hiddentear",
        "metro",
        "probe",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bleachgap",
        "formbook",
        "nanocore",
        "roblox",
        "heur",
        "cyber threat",
        "engineering",
        "malware",
        "phishing",
        "malicious site",
        "phishing site",
        "covid19",
        "team",
        "bank",
        "cobalt strike",
        "artemis",
        "download",
        "zbot",
        "suppobox",
        "service",
        "downloader",
        "virut",
        "malicious",
        "emotet",
        "stealer",
        "exploit",
        "generic",
        "dropper",
        "unruy",
        "agent",
        "unsafe",
        "ramnit",
        "redline stealer",
        "smsspy",
        "bradesco",
        "fakealert",
        "qakbot",
        "outbreak",
        "qbot",
        "bankerx",
        "riskware",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "squirrelwaffle",
        "pony",
        "binder",
        "virustotal",
        "azorult",
        "zeus",
        "nymaim",
        "matsnu",
        "simda",
        "runescape",
        "cutwail",
        "dnspionage",
        "redirector",
        "fusioncore",
        "iframe",
        "killav",
        "raccoon",
        "daum",
        "installcore",
        "ransomware",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "presenoker",
        "downldr",
        "alexa",
        "applicunwnt",
        "opencandy",
        "cleaner",
        "wacatac",
        "xrat",
        "xtrat",
        "dbatloader",
        "infy",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "phish",
        "deepscan",
        "trojanspy",
        "maltiverse",
        "qpyrn6pd",
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "*otc.greatcall.com    [Botnetwork]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
        "tulach.cc.     [Malevolent | Modified description]",
        "https://tulach.cc/ [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
      ],
      "public": 1,
      "adversary": "Qbot",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Roblox",
          "display_name": "Roblox",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 897,
        "FileHash-SHA1": 479,
        "URL": 9847,
        "domain": 2344,
        "hostname": 2398,
        "CVE": 22,
        "FileHash-SHA256": 4712
      },
      "indicator_count": 20699,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "848 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655f6d89b33758a190399f39",
      "name": "Qbot | Miscellaneous Attacks",
      "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
      "modified": "2023-12-23T07:03:55.171000",
      "created": "2023-11-23T15:19:37.838000",
      "tags": [
        "pattern match",
        "ascii text",
        "file",
        "jpeg image",
        "exif standard",
        "tiff image",
        "png image",
        "united",
        "baseline",
        "rgba",
        "date",
        "class",
        "unknown",
        "hybrid",
        "accept",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "error",
        "firehol",
        "detection list",
        "ip address",
        "blacklist",
        "botnet command",
        "control server",
        "noname057",
        "facebook",
        "phishtank",
        "blacklist http",
        "organization",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "n64xtx0vpihxzc",
        "whois whois",
        "qpyrn6pd http",
        "referrer",
        "execution",
        "communicating",
        "core",
        "discord",
        "hiddentear",
        "metro",
        "probe",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bleachgap",
        "formbook",
        "nanocore",
        "roblox",
        "heur",
        "cyber threat",
        "engineering",
        "malware",
        "phishing",
        "malicious site",
        "phishing site",
        "covid19",
        "team",
        "bank",
        "cobalt strike",
        "artemis",
        "download",
        "zbot",
        "suppobox",
        "service",
        "downloader",
        "virut",
        "malicious",
        "emotet",
        "stealer",
        "exploit",
        "generic",
        "dropper",
        "unruy",
        "agent",
        "unsafe",
        "ramnit",
        "redline stealer",
        "smsspy",
        "bradesco",
        "fakealert",
        "qakbot",
        "outbreak",
        "qbot",
        "bankerx",
        "riskware",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "squirrelwaffle",
        "pony",
        "binder",
        "virustotal",
        "azorult",
        "zeus",
        "nymaim",
        "matsnu",
        "simda",
        "runescape",
        "cutwail",
        "dnspionage",
        "redirector",
        "fusioncore",
        "iframe",
        "killav",
        "raccoon",
        "daum",
        "installcore",
        "ransomware",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "presenoker",
        "downldr",
        "alexa",
        "applicunwnt",
        "opencandy",
        "cleaner",
        "wacatac",
        "xrat",
        "xtrat",
        "dbatloader",
        "infy",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "phish",
        "deepscan",
        "trojanspy",
        "maltiverse",
        "qpyrn6pd",
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "*otc.greatcall.com    [Botnetwork]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
        "tulach.cc.     [Malevolent | Modified description]",
        "https://tulach.cc/ [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
      ],
      "public": 1,
      "adversary": "Qbot",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Roblox",
          "display_name": "Roblox",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 84,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 897,
        "FileHash-SHA1": 479,
        "URL": 9847,
        "domain": 2344,
        "hostname": 2398,
        "CVE": 22,
        "FileHash-SHA256": 4712
      },
      "indicator_count": 20699,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "848 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655f6edffd3910161c2ad1a2",
      "name": "D26A | DNSpionage| Qbot | Tulach Malaware | https://theanimallawfirm.com/ | FakeAlert",
      "description": "",
      "modified": "2023-12-23T07:03:55.171000",
      "created": "2023-11-23T15:25:19.843000",
      "tags": [
        "pattern match",
        "ascii text",
        "file",
        "jpeg image",
        "exif standard",
        "tiff image",
        "png image",
        "united",
        "baseline",
        "rgba",
        "date",
        "class",
        "unknown",
        "hybrid",
        "accept",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "error",
        "firehol",
        "detection list",
        "ip address",
        "blacklist",
        "botnet command",
        "control server",
        "noname057",
        "facebook",
        "phishtank",
        "blacklist http",
        "organization",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "n64xtx0vpihxzc",
        "whois whois",
        "qpyrn6pd http",
        "referrer",
        "execution",
        "communicating",
        "core",
        "discord",
        "hiddentear",
        "metro",
        "probe",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bleachgap",
        "formbook",
        "nanocore",
        "roblox",
        "heur",
        "cyber threat",
        "engineering",
        "malware",
        "phishing",
        "malicious site",
        "phishing site",
        "covid19",
        "team",
        "bank",
        "cobalt strike",
        "artemis",
        "download",
        "zbot",
        "suppobox",
        "service",
        "downloader",
        "virut",
        "malicious",
        "emotet",
        "stealer",
        "exploit",
        "generic",
        "dropper",
        "unruy",
        "agent",
        "unsafe",
        "ramnit",
        "redline stealer",
        "smsspy",
        "bradesco",
        "fakealert",
        "qakbot",
        "outbreak",
        "qbot",
        "bankerx",
        "riskware",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "squirrelwaffle",
        "pony",
        "binder",
        "virustotal",
        "azorult",
        "zeus",
        "nymaim",
        "matsnu",
        "simda",
        "runescape",
        "cutwail",
        "dnspionage",
        "redirector",
        "fusioncore",
        "iframe",
        "killav",
        "raccoon",
        "daum",
        "installcore",
        "ransomware",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "presenoker",
        "downldr",
        "alexa",
        "applicunwnt",
        "opencandy",
        "cleaner",
        "wacatac",
        "xrat",
        "xtrat",
        "dbatloader",
        "infy",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "phish",
        "deepscan",
        "trojanspy",
        "maltiverse",
        "qpyrn6pd",
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "*otc.greatcall.com    [Botnetwork]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
        "tulach.cc.     [Malevolent | Modified description]",
        "https://tulach.cc/ [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
      ],
      "public": 1,
      "adversary": "Qbot",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Roblox",
          "display_name": "Roblox",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "655f6d89b33758a190399f39",
      "export_count": 86,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 897,
        "FileHash-SHA1": 479,
        "URL": 9847,
        "domain": 2344,
        "hostname": 2398,
        "CVE": 22,
        "FileHash-SHA256": 4712
      },
      "indicator_count": 20699,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "848 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a8bf416a1c314819ea53",
      "name": "Remote Access Related |  APK attack targets independent artists",
      "description": "",
      "modified": "2023-12-06T17:00:47.888000",
      "created": "2023-12-06T17:00:47.888000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 5,
        "FileHash-SHA256": 2385,
        "hostname": 1054,
        "domain": 713,
        "URL": 3595,
        "FileHash-MD5": 1104,
        "FileHash-SHA1": 585,
        "FilePath": 1
      },
      "indicator_count": 9442,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a79534c615a8f10f3380",
      "name": "Qakbot | Info Stealer | Sourced:  Part-RU",
      "description": "",
      "modified": "2023-12-06T16:55:49.669000",
      "created": "2023-12-06T16:55:49.669000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2383,
        "hostname": 1027,
        "domain": 418,
        "URL": 2673,
        "FileHash-MD5": 99,
        "FileHash-SHA1": 98
      },
      "indicator_count": 6698,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 112,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6533ed2685e0fc66ac0628bd",
      "name": "Network capture | Gather Victim Network Information | C2",
      "description": "Botnet. Spammer. BN campaigners. Victim name used for marketing BN and porn. This website contains age-restricted material and contains explicit depictions of sexual activity, but does not ask for permission to access or access any of the site's materials. \u00c2\u00a9 Mile High Distribution Inc",
      "modified": "2023-11-20T11:03:09.867000",
      "created": "2023-10-21T15:24:22.377000",
      "tags": [
        "mile high",
        "logos",
        "trademarks",
        "aylo premium",
        "click",
        "record keeping",
        "statement",
        "all rights",
        "reserved",
        "vendo",
        "ssl certificate",
        "contacted",
        "whois record",
        "tsara brashears",
        "historical ssl",
        "apple",
        "password",
        "porn",
        "networks",
        "botnet campaign",
        "crypto",
        "installer",
        "attacker",
        "metro",
        "brazzers",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "maxage86400",
        "path",
        "html info",
        "title page",
        "found meta",
        "milehigh",
        "watch",
        "milfs",
        "trackers google",
        "analytics na",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "specific",
        "pattern match",
        "file",
        "ascii text",
        "windows nt",
        "jpeg image",
        "united",
        "appdata",
        "jfif",
        "mitre att",
        "date",
        "unknown",
        "hybrid",
        "accept",
        "general",
        "local",
        "strings",
        "class",
        "critical",
        "error",
        "server",
        "email",
        "code",
        "whois privacy",
        "domain status",
        "registrar abuse",
        "registrar url",
        "registrar",
        "registry domain",
        "C2",
        "organization",
        "threat level",
        "windir",
        "getpost",
        "name server",
        "openurl c"
      ],
      "references": [
        "https://www.milehighmedia.com/legal/2257                                     exploit_source  [Metro T-Mobile attacker. Brazzers  | T]",
        "https://www.sweetheartvideo.com/tsara-brashears/                    [Botnet tracking campaign, referrer]",
        "https://www.sweetheartvideo.com/tsara-brashears                      [Network ID]",
        "https://www.sweetheartvideo.com                                                       [Pattern match, Brashears]",
        "m1.sweetheartvideo.com                                                                            [mailer!]",
        "mba3.sweetheartvideo.com                                                                       [Server]",
        "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e           [Research Tool]",
        "Other",
        "browser.events.data.msn.com                                                                    [sandbox and archive browser events]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.004",
          "name": "Server",
          "display_name": "T1583.004 - Server"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4377,
        "FileHash-MD5": 128,
        "FileHash-SHA1": 127,
        "FileHash-SHA256": 2861,
        "domain": 829,
        "hostname": 1452,
        "CVE": 1,
        "email": 6
      },
      "indicator_count": 9781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "881 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ray.ns.cloudfare.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ray.ns.cloudfare.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776627804.8024125
}