{
  "type": "URL",
  "indicator": "https://recap-test.binginternal.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://recap-test.binginternal.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4136437559,
      "indicator": "https://recap-test.binginternal.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "68e2bb5d9ee8577ab5519f2c",
          "name": "Meritshealth with DoD links? ",
          "description": "",
          "modified": "2026-01-13T00:05:56.401000",
          "created": "2025-10-05T18:39:25.286000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "68e2b14d83bb63502feac65e",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1365,
            "URL": 11172,
            "hostname": 2780,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4420,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 20486,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "96 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68e2b14d83bb63502feac65e",
          "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
          "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
          "modified": "2026-01-07T00:00:30.717000",
          "created": "2025-10-05T17:56:29.109000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1328,
            "URL": 9931,
            "hostname": 2621,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4360,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 18989,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "102 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "690e8b773dc39921d88abd44",
          "name": "Nanocore - Affected",
          "description": "- wmsspacer.gif\n| Photography: WMSspacer.gif, |[wmstransparent.org,]\n* YARA Detections : \nDotNET_Reactor\nSystem.Security.Cryptography.AesCryptoServiceProvider\nSystem.Security.Cryptography\nSystem.Security.Cryptography ~\nI CryptoTransform |\n Wmsspacer, i.g.sg.js..png.com, on-screen.|",
          "modified": "2025-12-07T23:02:29.645000",
          "created": "2025-11-08T00:14:47.600000",
          "tags": [
            "hgnvastlaiz",
            "read c",
            "medium",
            "rgba",
            "memcommit",
            "delete",
            "png image",
            "unicode",
            "dock",
            "execution",
            "malware",
            "crlf line",
            "speichermedium",
            "productversion",
            "fileversion",
            "engine dll",
            "internalname",
            "einstellungen",
            "comodo ca",
            "limited st",
            "yara detections",
            "next pe",
            "eula",
            "policy",
            "direct",
            "opencandy",
            "suspicious_write_exe",
            "network_icmp",
            "process_martian",
            "present jun",
            "present jul",
            "domain",
            "united",
            "ip address",
            "unknown ns",
            "ms windows",
            "intel",
            "verisign",
            "time stamping",
            "unknown",
            "class",
            "write",
            "markus",
            "temple",
            "msie",
            "windows nt",
            "get http",
            "lehash",
            "av detections",
            "ids detections",
            "alerts",
            "file score",
            "low risk",
            "compromised_site_redirector_fromcharcode",
            "present aug",
            "passive dns",
            "all ipv4",
            "urls",
            "files",
            "hosting",
            "america flag",
            "win32",
            "ipv4 add",
            "signed file, valid signature. revoked.",
            "united states",
            "pws",
            "atros",
            "fiha",
            "search",
            "entries",
            "present oct",
            "next associated",
            "show",
            "high",
            "wow64",
            "slcc2",
            "next",
            "domain add",
            "poland",
            "poland unknown",
            "ipv4",
            "location poland",
            "poland asn",
            "et policy",
            "pe exe",
            "dll windows",
            "amazon s3",
            "location united",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results feb",
            "nanocore",
            "url add",
            "http",
            "related nids",
            "files location",
            "flag united",
            "malicious image",
            "files domain",
            "files related",
            "pulses otx",
            "related tags",
            "resources whois",
            "virustotal",
            "present sep",
            "status",
            "present nov",
            "present mar",
            "trojan",
            "script script",
            "div div",
            "link",
            "a li",
            "meta",
            "sweden",
            "invalid url",
            "head title",
            "title head",
            "reference",
            "bad request",
            "server",
            "netherlands",
            "creation date",
            "date",
            "running server",
            "ahmann",
            "christopher",
            "p",
            "tam",
            "legal",
            "treece",
            "alfrey",
            "muscat",
            "adversaries",
            "cyber crime",
            "quasi",
            "government"
          ],
          "references": [
            "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
            "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
            "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
            "www.opencandy.com",
            "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
            "Yara Detections : compromised_site_redirector_fromcharcode",
            "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
            "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
            "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
            "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
            "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
            "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
            "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
            "https://heavyfetish.com/search/CHEESE-PIZZA-porn/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Nanocore-5",
              "display_name": "Win.Trojan.Nanocore-5",
              "target": null
            },
            {
              "id": "Win.Trojan.Adinstall-2",
              "display_name": "Win.Trojan.Adinstall-2",
              "target": null
            },
            {
              "id": "PSW.Generic13",
              "display_name": "PSW.Generic13",
              "target": null
            },
            {
              "id": "Atros.UPK",
              "display_name": "Atros.UPK",
              "target": null
            },
            {
              "id": "Luhe.Fiha.A",
              "display_name": "Luhe.Fiha.A",
              "target": null
            },
            {
              "id": "Pua.Optimizerpro/PCOptimizerPro",
              "display_name": "Pua.Optimizerpro/PCOptimizerPro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1491.001",
              "name": "Internal Defacement",
              "display_name": "T1491.001 - Internal Defacement"
            },
            {
              "id": "T1204.003",
              "name": "Malicious Image",
              "display_name": "T1204.003 - Malicious Image"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 753,
            "FileHash-SHA1": 622,
            "FileHash-SHA256": 4336,
            "URL": 2448,
            "domain": 300,
            "hostname": 788,
            "CVE": 1,
            "email": 4
          },
          "indicator_count": 9252,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "132 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68feb98a8c1b75b4431a3e8e",
          "name": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator?",
          "description": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator? 1.) (userlolxxl)  is also disable_duck, has an unhealthy interest in the Tsara Brashears \u2018dead yet\u2019 theory , has many profiles. His issues are self made by grabbing vulnerabilities found and linking them to a fake University website. We checked. Profile belongs to a group causing needless distraction and hooking users into the \u2018No Problems\u2019 group. \n\nWe swiftly got Regis University to take notice of Palantirs Prometheus Intelligence Technology tracking. Dean let semester begin putting students at risk despite warnings from Tsara Brashears of owa canary cookie in server, to replace computers , halt school , deal with issue. RU ignored issues,  Brashears didn\u2019t. They went black , blacklisted Tsara  warning of credible death threats on dark web.",
          "modified": "2025-11-25T20:05:31.749000",
          "created": "2025-10-27T00:15:06.191000",
          "tags": [
            "html internet",
            "html document",
            "ascii text",
            "language",
            "cve202323397",
            "iframe tags",
            "tag manager",
            "gtmkvjvztk",
            "anchor hrefs",
            "info ta0011",
            "protocol",
            "layer protocol",
            "port",
            "t1571 encrypted",
            "channel",
            "t1573 malware",
            "tree",
            "oc0006 http",
            "c0014",
            "get http",
            "dns resolutions",
            "resolved ips",
            "user",
            "data",
            "datacrashpad",
            "edge",
            "v full",
            "reports v",
            "chrome u",
            "appdata local",
            "googlechrome u",
            "u ser",
            "cname",
            "ip address",
            "http",
            "accept",
            "network dropped",
            "duration cuckoo",
            "version file",
            "machine label",
            "shutdown",
            "extraction",
            "suggested iocs",
            "data upload",
            "cry dee",
            "stop",
            "type",
            "url indicator",
            "enter",
            "failed",
            "se share",
            "extrac",
            "enter so",
            "passive dns",
            "urls",
            "hostname add",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as20473",
            "dynamicloader",
            "directui",
            "write c",
            "intel",
            "ms windows",
            "pe32",
            "element",
            "delete c",
            "document file",
            "v2 document",
            "explorer",
            "trojandropper",
            "write",
            "markus",
            "august",
            "movie",
            "insert",
            "pulse submit",
            "url analysis",
            "asn as8068",
            "united",
            "entries",
            "body",
            "please",
            "x msedge",
            "ipv4 add",
            "present sep",
            "present oct",
            "present feb",
            "status",
            "unknown ns",
            "search",
            "name servers",
            "present jul",
            "aaaa",
            "present apr",
            "trojan",
            "medium",
            "high",
            "yara rule",
            "globalc",
            "june",
            "malware",
            "win64",
            "unknown",
            "america flag",
            "twitter",
            "hostname",
            "domain add",
            "reverse dns",
            "america asn",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "unknown aaaa",
            "title",
            "meta",
            "window",
            "encrypt",
            "pulse indicator",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "atlanta",
            "abuse",
            "agent",
            "service",
            "present jun",
            "present may",
            "creation date",
            "record value",
            "servers",
            "libretv meta",
            "certificate",
            "value",
            "whois lookup",
            "loopia ab",
            "userlolxxl"
          ],
          "references": [
            "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
            "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
            "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
            "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
            "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
            "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
            "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
            "https://hs.ecam.com/your-challenges-ecams-solutions",
            "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
            "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
            "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Wannacry",
              "display_name": "Wannacry",
              "target": null
            },
            {
              "id": "Foundry",
              "display_name": "Foundry",
              "target": null
            },
            {
              "id": "Trojan:Win32/Comisproc!gmb",
              "display_name": "Trojan:Win32/Comisproc!gmb",
              "target": "/malware/Trojan:Win32/Comisproc!gmb"
            },
            {
              "id": "Trojandropper:Win32/VB.IL",
              "display_name": "Trojandropper:Win32/VB.IL",
              "target": "/malware/Trojandropper:Win32/VB.IL"
            },
            {
              "id": "#Exploit:Win32/CVE- 2023 - 23397",
              "display_name": "#Exploit:Win32/CVE- 2023 - 23397",
              "target": "/malware/#Exploit:Win32/CVE- 2023 - 23397"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "ALF:PulZati:Worm:Win32/Mydoom",
              "display_name": "ALF:PulZati:Worm:Win32/Mydoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 8,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 248,
            "FileHash-SHA1": 134,
            "FileHash-SHA256": 2661,
            "URL": 6257,
            "domain": 682,
            "email": 8,
            "hostname": 2077,
            "CVE": 1
          },
          "indicator_count": 12068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "144 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fd0cc422cea2fd989581fd",
          "name": "LevelBlue - Open Threat Exchange (Malicious Attacks)",
          "description": "I\u2019ll\nrefer to these bad actors as the .lol .fun group. London, Australia , South Africa with US base External resources. With this group, you e probably met though attackers.. OTX errors! Difficult to pulse. There are some profiles in here that are shady and attempt or do co connect to your products. They usually begin social engineering by saying that you have a \u2018problem\u2019 just like they do. Say they are from Canada or\nFrance , somewhere abroad when they are down the street using your services. There was user \u2018Merkd\u2019 whose entire system seem to become infected by someone or someone about this platform. Check the IP address at all\nTo see if it matches or is on the same block as OTC, region will show as well. Hackers may potentially cnc / move your profile on their own block. What happened today was weird. Alien Vault became a PHP and turned bright pink and black, requesting I download page. Keep your systems locked down if you\u2019re researching not reporting vulnerabilities.",
          "modified": "2025-11-24T17:02:12.441000",
          "created": "2025-10-25T17:45:40.291000",
          "tags": [
            "ipv4",
            "levelblue",
            "open threat",
            "date sat",
            "connection",
            "etag w",
            "cloudfront",
            "sameorigin age",
            "vary",
            "ip address",
            "kb body",
            "gtmkvjvztk",
            "utc gcfezl5ynvb",
            "utc na",
            "utc google",
            "analytics na",
            "utc linkedin",
            "insight tag",
            "learn",
            "exchange og",
            "levelblue open",
            "threat exchange",
            "exchange",
            "google tag",
            "iocs",
            "search otx",
            "included iocs",
            "review iocs",
            "data upload",
            "extraction",
            "layer protocol",
            "v full",
            "reports v",
            "port t1571",
            "t1573",
            "oc0006 http",
            "c0014",
            "get http",
            "dns resolutions",
            "user",
            "data",
            "datacrashpad",
            "edge",
            "tag manager",
            "us er",
            "help files",
            "shell",
            "html",
            "cve202323397",
            "iframe tags",
            "community score",
            "url http",
            "url https",
            "united",
            "united kingdom",
            "netherlands",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "indicator role",
            "title added",
            "active related",
            "otc oct",
            "report spam",
            "week ago",
            "scan",
            "learn more",
            "filehashmd5",
            "filehashsha1",
            "domain",
            "australia",
            "does",
            "josh",
            "created",
            "filehashsha256",
            "present jul",
            "present oct",
            "date",
            "a domains",
            "script urls",
            "for privacy",
            "moved",
            "script domains",
            "meta",
            "title",
            "body",
            "pragma",
            "encrypt",
            "ck ids",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1027",
            "files",
            "information",
            "t1055",
            "injection",
            "capture",
            "south korea",
            "malaysia",
            "pulses",
            "fatal error",
            "hacker known",
            "name",
            "unknown",
            "risk",
            "weeks ago",
            "scary",
            "sova",
            "colorado",
            "wire",
            "name unknown",
            "thursday",
            "denver",
            "types of",
            "indicators hong",
            "kong",
            "tsara brashears",
            "african",
            "ethiopia",
            "b8reactjs",
            "india",
            "america",
            "x ua",
            "hostname",
            "dicator role",
            "pulses url",
            "airplane",
            "icator role",
            "t1432",
            "access contact",
            "list",
            "t1525",
            "image",
            "security scan",
            "heuristic oct",
            "discovery",
            "t1069",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1114",
            "t1480",
            "internal image",
            "brian sabey",
            "month ago",
            "modified",
            "days ago",
            "green well",
            "sabey stash",
            "service",
            "t1040",
            "sniffing",
            "t1045",
            "packing",
            "t1053",
            "taskjob"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Sova",
              "display_name": "Sova",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1022",
              "name": "Data Encrypted",
              "display_name": "T1022 - Data Encrypted"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1432",
              "name": "Access Contact List",
              "display_name": "T1432 - Access Contact List"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1525",
              "name": "Implant Internal Image",
              "display_name": "T1525 - Implant Internal Image"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 956,
            "FileHash-SHA1": 906,
            "FileHash-SHA256": 2651,
            "URL": 4450,
            "domain": 708,
            "hostname": 2403,
            "CVE": 1,
            "email": 5
          },
          "indicator_count": 12080,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "145 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68dc624893ea922b898f911b",
          "name": "FBI? Ghe real one? Idk - Cab / Deive by compromised an iOS device",
          "description": "Checking a targets phone, it\u2019s seems very infected with limited results on google searches results. I clicked on an image I thought looked suspicious. Image was coded. I have no idea if this is the FBI I haven\u2019t examined or researched for vulnerabilities yet. I will break this down over time. The number is kept alive but number could not be verified , it was a different number altogether. The phone was out of service, I reached out to 911. And spoke to a person I can\u2019t verify. The service was reconnected a day later. It\u2019s a very crazy hack!",
          "modified": "2025-10-30T22:01:00.256000",
          "created": "2025-09-30T23:05:44.154000",
          "tags": [
            "search",
            "google search",
            "in a",
            "relevance",
            "internet storm",
            "intranet",
            "part",
            "steps",
            "hyper v",
            "windowssystem32",
            "ping request",
            "algorithm",
            "ouno sni",
            "key usage",
            "google llc",
            "v3 serial",
            "number",
            "public key",
            "info",
            "key algorithm",
            "domain",
            "subject key",
            "identifier",
            "net173",
            "net1730000",
            "gogl",
            "orgid",
            "gogl address",
            "city",
            "mountain view",
            "stateprov",
            "postalcode",
            "registrar",
            "ip address",
            "http",
            "port",
            "accept",
            "info file",
            "network dropped",
            "duration cuckoo",
            "version file",
            "machine label",
            "shutdown",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "defense evasion",
            "spawns",
            "found",
            "united",
            "ascii text",
            "pattern match",
            "mitre att",
            "title",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "body",
            "initial access",
            "local",
            "passive dns",
            "urls",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "backdoor",
            "status",
            "aaaa",
            "date",
            "name servers",
            "record value",
            "emails",
            "present aug",
            "present sep",
            "moved",
            "error",
            "antivm",
            "drive by",
            "cab by"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 544,
            "FileHash-SHA256": 2300,
            "URL": 3905,
            "hostname": 1675,
            "FileHash-MD5": 209,
            "FileHash-SHA1": 210,
            "CIDR": 1,
            "email": 7,
            "SSLCertFingerprint": 8,
            "CVE": 2
          },
          "indicator_count": 8861,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "170 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "I am very upset. Whoever is doing this is sick.",
        "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "Can the DoD no questions asked target a SA victim",
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "There is fear in silence or speaking out",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
        "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
        "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
        "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
        "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "Yara Detections : compromised_site_redirector_fromcharcode",
        "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://heavyfetish.com/search/CHEESE-PIZZA-porn/",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
        "If someone is believed to be a threat they have right to due process.",
        "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
        "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
        "https://hs.ecam.com/your-challenges-ecams-solutions",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "iamrobert.com Y.A.S.",
        "https://es.pornhat.com/models/the-sex-creator/",
        "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
        "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
        "https://meumundogay-com.sexogratis.page/locker",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "Target agreed and complied with all lie detector measures.",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
        "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "www.opencandy.com",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
        "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Malware",
            "Trojandropper:win32/vb.il",
            "Wannacry",
            "Luhe.fiha.a",
            "Win.trojan.nanocore-5",
            "Pua.optimizerpro/pcoptimizerpro",
            "#exploit:win32/cve- 2023 - 23397",
            "Foundry",
            "Pegasus",
            "Psw.generic13",
            "Win.trojan.adinstall-2",
            "Alf:pulzati:worm:win32/mydoom",
            "Trojan:win32/comisproc!gmb",
            "Sova",
            "Apnic",
            "Atros.upk"
          ],
          "industries": [],
          "unique_indicators": 55070
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/binginternal.com",
    "whois": "http://whois.domaintools.com/binginternal.com",
    "domain": "binginternal.com",
    "hostname": "recap-test.binginternal.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "68e2bb5d9ee8577ab5519f2c",
      "name": "Meritshealth with DoD links? ",
      "description": "",
      "modified": "2026-01-13T00:05:56.401000",
      "created": "2025-10-05T18:39:25.286000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "68e2b14d83bb63502feac65e",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1365,
        "URL": 11172,
        "hostname": 2780,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4420,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 20486,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "96 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68e2b14d83bb63502feac65e",
      "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
      "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
      "modified": "2026-01-07T00:00:30.717000",
      "created": "2025-10-05T17:56:29.109000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1328,
        "URL": 9931,
        "hostname": 2621,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4360,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 18989,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "102 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "690e8b773dc39921d88abd44",
      "name": "Nanocore - Affected",
      "description": "- wmsspacer.gif\n| Photography: WMSspacer.gif, |[wmstransparent.org,]\n* YARA Detections : \nDotNET_Reactor\nSystem.Security.Cryptography.AesCryptoServiceProvider\nSystem.Security.Cryptography\nSystem.Security.Cryptography ~\nI CryptoTransform |\n Wmsspacer, i.g.sg.js..png.com, on-screen.|",
      "modified": "2025-12-07T23:02:29.645000",
      "created": "2025-11-08T00:14:47.600000",
      "tags": [
        "hgnvastlaiz",
        "read c",
        "medium",
        "rgba",
        "memcommit",
        "delete",
        "png image",
        "unicode",
        "dock",
        "execution",
        "malware",
        "crlf line",
        "speichermedium",
        "productversion",
        "fileversion",
        "engine dll",
        "internalname",
        "einstellungen",
        "comodo ca",
        "limited st",
        "yara detections",
        "next pe",
        "eula",
        "policy",
        "direct",
        "opencandy",
        "suspicious_write_exe",
        "network_icmp",
        "process_martian",
        "present jun",
        "present jul",
        "domain",
        "united",
        "ip address",
        "unknown ns",
        "ms windows",
        "intel",
        "verisign",
        "time stamping",
        "unknown",
        "class",
        "write",
        "markus",
        "temple",
        "msie",
        "windows nt",
        "get http",
        "lehash",
        "av detections",
        "ids detections",
        "alerts",
        "file score",
        "low risk",
        "compromised_site_redirector_fromcharcode",
        "present aug",
        "passive dns",
        "all ipv4",
        "urls",
        "files",
        "hosting",
        "america flag",
        "win32",
        "ipv4 add",
        "signed file, valid signature. revoked.",
        "united states",
        "pws",
        "atros",
        "fiha",
        "search",
        "entries",
        "present oct",
        "next associated",
        "show",
        "high",
        "wow64",
        "slcc2",
        "next",
        "domain add",
        "poland",
        "poland unknown",
        "ipv4",
        "location poland",
        "poland asn",
        "et policy",
        "pe exe",
        "dll windows",
        "amazon s3",
        "location united",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results feb",
        "nanocore",
        "url add",
        "http",
        "related nids",
        "files location",
        "flag united",
        "malicious image",
        "files domain",
        "files related",
        "pulses otx",
        "related tags",
        "resources whois",
        "virustotal",
        "present sep",
        "status",
        "present nov",
        "present mar",
        "trojan",
        "script script",
        "div div",
        "link",
        "a li",
        "meta",
        "sweden",
        "invalid url",
        "head title",
        "title head",
        "reference",
        "bad request",
        "server",
        "netherlands",
        "creation date",
        "date",
        "running server",
        "ahmann",
        "christopher",
        "p",
        "tam",
        "legal",
        "treece",
        "alfrey",
        "muscat",
        "adversaries",
        "cyber crime",
        "quasi",
        "government"
      ],
      "references": [
        "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
        "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
        "www.opencandy.com",
        "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
        "Yara Detections : compromised_site_redirector_fromcharcode",
        "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
        "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
        "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
        "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
        "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
        "https://heavyfetish.com/search/CHEESE-PIZZA-porn/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Nanocore-5",
          "display_name": "Win.Trojan.Nanocore-5",
          "target": null
        },
        {
          "id": "Win.Trojan.Adinstall-2",
          "display_name": "Win.Trojan.Adinstall-2",
          "target": null
        },
        {
          "id": "PSW.Generic13",
          "display_name": "PSW.Generic13",
          "target": null
        },
        {
          "id": "Atros.UPK",
          "display_name": "Atros.UPK",
          "target": null
        },
        {
          "id": "Luhe.Fiha.A",
          "display_name": "Luhe.Fiha.A",
          "target": null
        },
        {
          "id": "Pua.Optimizerpro/PCOptimizerPro",
          "display_name": "Pua.Optimizerpro/PCOptimizerPro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1491.001",
          "name": "Internal Defacement",
          "display_name": "T1491.001 - Internal Defacement"
        },
        {
          "id": "T1204.003",
          "name": "Malicious Image",
          "display_name": "T1204.003 - Malicious Image"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 753,
        "FileHash-SHA1": 622,
        "FileHash-SHA256": 4336,
        "URL": 2448,
        "domain": 300,
        "hostname": 788,
        "CVE": 1,
        "email": 4
      },
      "indicator_count": 9252,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "132 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68feb98a8c1b75b4431a3e8e",
      "name": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator?",
      "description": "LevelBlue - Open Threat Exchange (userlolxxl) Administrator? 1.) (userlolxxl)  is also disable_duck, has an unhealthy interest in the Tsara Brashears \u2018dead yet\u2019 theory , has many profiles. His issues are self made by grabbing vulnerabilities found and linking them to a fake University website. We checked. Profile belongs to a group causing needless distraction and hooking users into the \u2018No Problems\u2019 group. \n\nWe swiftly got Regis University to take notice of Palantirs Prometheus Intelligence Technology tracking. Dean let semester begin putting students at risk despite warnings from Tsara Brashears of owa canary cookie in server, to replace computers , halt school , deal with issue. RU ignored issues,  Brashears didn\u2019t. They went black , blacklisted Tsara  warning of credible death threats on dark web.",
      "modified": "2025-11-25T20:05:31.749000",
      "created": "2025-10-27T00:15:06.191000",
      "tags": [
        "html internet",
        "html document",
        "ascii text",
        "language",
        "cve202323397",
        "iframe tags",
        "tag manager",
        "gtmkvjvztk",
        "anchor hrefs",
        "info ta0011",
        "protocol",
        "layer protocol",
        "port",
        "t1571 encrypted",
        "channel",
        "t1573 malware",
        "tree",
        "oc0006 http",
        "c0014",
        "get http",
        "dns resolutions",
        "resolved ips",
        "user",
        "data",
        "datacrashpad",
        "edge",
        "v full",
        "reports v",
        "chrome u",
        "appdata local",
        "googlechrome u",
        "u ser",
        "cname",
        "ip address",
        "http",
        "accept",
        "network dropped",
        "duration cuckoo",
        "version file",
        "machine label",
        "shutdown",
        "extraction",
        "suggested iocs",
        "data upload",
        "cry dee",
        "stop",
        "type",
        "url indicator",
        "enter",
        "failed",
        "se share",
        "extrac",
        "enter so",
        "passive dns",
        "urls",
        "hostname add",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as20473",
        "dynamicloader",
        "directui",
        "write c",
        "intel",
        "ms windows",
        "pe32",
        "element",
        "delete c",
        "document file",
        "v2 document",
        "explorer",
        "trojandropper",
        "write",
        "markus",
        "august",
        "movie",
        "insert",
        "pulse submit",
        "url analysis",
        "asn as8068",
        "united",
        "entries",
        "body",
        "please",
        "x msedge",
        "ipv4 add",
        "present sep",
        "present oct",
        "present feb",
        "status",
        "unknown ns",
        "search",
        "name servers",
        "present jul",
        "aaaa",
        "present apr",
        "trojan",
        "medium",
        "high",
        "yara rule",
        "globalc",
        "june",
        "malware",
        "win64",
        "unknown",
        "america flag",
        "twitter",
        "hostname",
        "domain add",
        "reverse dns",
        "america asn",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "unknown aaaa",
        "title",
        "meta",
        "window",
        "encrypt",
        "pulse indicator",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "atlanta",
        "abuse",
        "agent",
        "service",
        "present jun",
        "present may",
        "creation date",
        "record value",
        "servers",
        "libretv meta",
        "certificate",
        "value",
        "whois lookup",
        "loopia ab",
        "userlolxxl"
      ],
      "references": [
        "http://clients2.google.com/time/1/current?cup2key=8:A2NSA9XiMjwnv2lppZDHJSlUjwebkbP0FRGtnA3Onzw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "OTX issues | http://oracle.com/contracts.- I\u2019m wondering if vulnerabilities found put us on a watchlist",
        "It\u2019s not  doesn\u2019t bother me. This is a great tool for quick ACCURATE results. Watch it happen live!",
        "pegasus.thalamus.nz \u2022 http://pegasus.thalamus.nz\t\u2022 https://pegasus.thalamus.nz",
        "Personally Interested:  sebastianfoliaco.com \u2022 sebagofinland.com \u2022 cpcontacts.sebastianfoliaco.com",
        "docs-api-staging.foundry.io \u2022  foundry.neconsside.com \u2022  http://foundry.neconsside.com \u2022 https://foundry.neconsside.com",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930933603/trips",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930956545",
        "https://cloud.eu.samsara.com/o/562949953429579/fleet/reports/cameras/844424930985776/trips",
        "https://hs.ecam.com/your-challenges-ecams-solutions",
        "https://teja8.kuikr.com/i6/20181130/Apple \u2022 https://teja8.kuikr.com/images/chat/new-chat/apple.png \u2022",
        "https://cdn-api.ravendawn.online/assets/apple-YLDDa8Br.png&quot\t hostname\tas.ultraapple.ipv64.net\t\u2022ipv64.net \u2022https://cdn.goilobby.com/email-notifications/addtoapplewallet.png \u2022 https://as.ultraapple.ipv64.net/",
        "Thalamus.nz - Registrar Dreamscape Networks International Pte Ltd t/a Crazy Domains"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Wannacry",
          "display_name": "Wannacry",
          "target": null
        },
        {
          "id": "Foundry",
          "display_name": "Foundry",
          "target": null
        },
        {
          "id": "Trojan:Win32/Comisproc!gmb",
          "display_name": "Trojan:Win32/Comisproc!gmb",
          "target": "/malware/Trojan:Win32/Comisproc!gmb"
        },
        {
          "id": "Trojandropper:Win32/VB.IL",
          "display_name": "Trojandropper:Win32/VB.IL",
          "target": "/malware/Trojandropper:Win32/VB.IL"
        },
        {
          "id": "#Exploit:Win32/CVE- 2023 - 23397",
          "display_name": "#Exploit:Win32/CVE- 2023 - 23397",
          "target": "/malware/#Exploit:Win32/CVE- 2023 - 23397"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "ALF:PulZati:Worm:Win32/Mydoom",
          "display_name": "ALF:PulZati:Worm:Win32/Mydoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 8,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 248,
        "FileHash-SHA1": 134,
        "FileHash-SHA256": 2661,
        "URL": 6257,
        "domain": 682,
        "email": 8,
        "hostname": 2077,
        "CVE": 1
      },
      "indicator_count": 12068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "144 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fd0cc422cea2fd989581fd",
      "name": "LevelBlue - Open Threat Exchange (Malicious Attacks)",
      "description": "I\u2019ll\nrefer to these bad actors as the .lol .fun group. London, Australia , South Africa with US base External resources. With this group, you e probably met though attackers.. OTX errors! Difficult to pulse. There are some profiles in here that are shady and attempt or do co connect to your products. They usually begin social engineering by saying that you have a \u2018problem\u2019 just like they do. Say they are from Canada or\nFrance , somewhere abroad when they are down the street using your services. There was user \u2018Merkd\u2019 whose entire system seem to become infected by someone or someone about this platform. Check the IP address at all\nTo see if it matches or is on the same block as OTC, region will show as well. Hackers may potentially cnc / move your profile on their own block. What happened today was weird. Alien Vault became a PHP and turned bright pink and black, requesting I download page. Keep your systems locked down if you\u2019re researching not reporting vulnerabilities.",
      "modified": "2025-11-24T17:02:12.441000",
      "created": "2025-10-25T17:45:40.291000",
      "tags": [
        "ipv4",
        "levelblue",
        "open threat",
        "date sat",
        "connection",
        "etag w",
        "cloudfront",
        "sameorigin age",
        "vary",
        "ip address",
        "kb body",
        "gtmkvjvztk",
        "utc gcfezl5ynvb",
        "utc na",
        "utc google",
        "analytics na",
        "utc linkedin",
        "insight tag",
        "learn",
        "exchange og",
        "levelblue open",
        "threat exchange",
        "exchange",
        "google tag",
        "iocs",
        "search otx",
        "included iocs",
        "review iocs",
        "data upload",
        "extraction",
        "layer protocol",
        "v full",
        "reports v",
        "port t1571",
        "t1573",
        "oc0006 http",
        "c0014",
        "get http",
        "dns resolutions",
        "user",
        "data",
        "datacrashpad",
        "edge",
        "tag manager",
        "us er",
        "help files",
        "shell",
        "html",
        "cve202323397",
        "iframe tags",
        "community score",
        "url http",
        "url https",
        "united",
        "united kingdom",
        "netherlands",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "indicator role",
        "title added",
        "active related",
        "otc oct",
        "report spam",
        "week ago",
        "scan",
        "learn more",
        "filehashmd5",
        "filehashsha1",
        "domain",
        "australia",
        "does",
        "josh",
        "created",
        "filehashsha256",
        "present jul",
        "present oct",
        "date",
        "a domains",
        "script urls",
        "for privacy",
        "moved",
        "script domains",
        "meta",
        "title",
        "body",
        "pragma",
        "encrypt",
        "ck ids",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1027",
        "files",
        "information",
        "t1055",
        "injection",
        "capture",
        "south korea",
        "malaysia",
        "pulses",
        "fatal error",
        "hacker known",
        "name",
        "unknown",
        "risk",
        "weeks ago",
        "scary",
        "sova",
        "colorado",
        "wire",
        "name unknown",
        "thursday",
        "denver",
        "types of",
        "indicators hong",
        "kong",
        "tsara brashears",
        "african",
        "ethiopia",
        "b8reactjs",
        "india",
        "america",
        "x ua",
        "hostname",
        "dicator role",
        "pulses url",
        "airplane",
        "icator role",
        "t1432",
        "access contact",
        "list",
        "t1525",
        "image",
        "security scan",
        "heuristic oct",
        "discovery",
        "t1069",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1114",
        "t1480",
        "internal image",
        "brian sabey",
        "month ago",
        "modified",
        "days ago",
        "green well",
        "sabey stash",
        "service",
        "t1040",
        "sniffing",
        "t1045",
        "packing",
        "t1053",
        "taskjob"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Sova",
          "display_name": "Sova",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1022",
          "name": "Data Encrypted",
          "display_name": "T1022 - Data Encrypted"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1432",
          "name": "Access Contact List",
          "display_name": "T1432 - Access Contact List"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1525",
          "name": "Implant Internal Image",
          "display_name": "T1525 - Implant Internal Image"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 956,
        "FileHash-SHA1": 906,
        "FileHash-SHA256": 2651,
        "URL": 4450,
        "domain": 708,
        "hostname": 2403,
        "CVE": 1,
        "email": 5
      },
      "indicator_count": 12080,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "145 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68dc624893ea922b898f911b",
      "name": "FBI? Ghe real one? Idk - Cab / Deive by compromised an iOS device",
      "description": "Checking a targets phone, it\u2019s seems very infected with limited results on google searches results. I clicked on an image I thought looked suspicious. Image was coded. I have no idea if this is the FBI I haven\u2019t examined or researched for vulnerabilities yet. I will break this down over time. The number is kept alive but number could not be verified , it was a different number altogether. The phone was out of service, I reached out to 911. And spoke to a person I can\u2019t verify. The service was reconnected a day later. It\u2019s a very crazy hack!",
      "modified": "2025-10-30T22:01:00.256000",
      "created": "2025-09-30T23:05:44.154000",
      "tags": [
        "search",
        "google search",
        "in a",
        "relevance",
        "internet storm",
        "intranet",
        "part",
        "steps",
        "hyper v",
        "windowssystem32",
        "ping request",
        "algorithm",
        "ouno sni",
        "key usage",
        "google llc",
        "v3 serial",
        "number",
        "public key",
        "info",
        "key algorithm",
        "domain",
        "subject key",
        "identifier",
        "net173",
        "net1730000",
        "gogl",
        "orgid",
        "gogl address",
        "city",
        "mountain view",
        "stateprov",
        "postalcode",
        "registrar",
        "ip address",
        "http",
        "port",
        "accept",
        "info file",
        "network dropped",
        "duration cuckoo",
        "version file",
        "machine label",
        "shutdown",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "defense evasion",
        "spawns",
        "found",
        "united",
        "ascii text",
        "pattern match",
        "mitre att",
        "title",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "body",
        "initial access",
        "local",
        "passive dns",
        "urls",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "backdoor",
        "status",
        "aaaa",
        "date",
        "name servers",
        "record value",
        "emails",
        "present aug",
        "present sep",
        "moved",
        "error",
        "antivm",
        "drive by",
        "cab by"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 544,
        "FileHash-SHA256": 2300,
        "URL": 3905,
        "hostname": 1675,
        "FileHash-MD5": 209,
        "FileHash-SHA1": 210,
        "CIDR": 1,
        "email": 7,
        "SSLCertFingerprint": 8,
        "CVE": 2
      },
      "indicator_count": 8861,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "170 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://recap-test.binginternal.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://recap-test.binginternal.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776597094.1752012
}