{
  "type": "URL",
  "indicator": "https://sentry.ad-maven.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://sentry.ad-maven.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4098394713,
      "indicator": "https://sentry.ad-maven.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "695035a98f01d94b2598f8ee",
          "name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University",
          "description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were  found. \n\nAll attacks immediately following assault.",
          "modified": "2026-01-26T18:04:20.395000",
          "created": "2025-12-27T19:38:17.198000",
          "tags": [
            "united",
            "unknown aaaa",
            "accept encoding",
            "moved",
            "urls",
            "files",
            "encrypt",
            "passive dns",
            "all ipv4",
            "america flag",
            "america asn",
            "ransom",
            "backdoor",
            "mtb win32",
            "mirai",
            "united states",
            "type indicator",
            "role title",
            "container",
            "ip address",
            "i div",
            "h2 p",
            "h4 p",
            "data",
            "desktop",
            "powerful",
            "url https",
            "url http",
            "indicator role",
            "active related",
            "cidr",
            "types",
            "indicators show",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "defense evasion",
            "spawns",
            "mitre att",
            "ck matrix",
            "command decode",
            "programfiles",
            "suricata ipv4",
            "windir",
            "comspec",
            "hybrid",
            "general",
            "path",
            "model",
            "click",
            "strings",
            "prometheus",
            "palantir",
            "kill list",
            "tracking",
            "moon linksys",
            "router",
            "emotet",
            "active",
            "regis university",
            "ascii text",
            "show technique",
            "pattern match",
            "sha1",
            "show process",
            "root",
            "local",
            "development att",
            "ssl certificate",
            "extranet",
            "maven"
          ],
          "references": [
            "Palantir Extranet -https://prometheusintelligencetechnology.com/",
            "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
            "IDS Detections: TheMoon.linksys.router",
            "We don\u2019t know how Octoseek & ScoreBlie (Team8)  became part of \u2018No Problems\u2019",
            "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
            "This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
            "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
            "Tsara Brashears warned of hack, provided detailed information, provided advice",
            "\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
            "Find a way to safely begin from a new server. Work from a Virtual World Class",
            "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
            "Old staff slow, foolish but eventually heeded instructions / once it was too late",
            "Dean is deceased?  Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
            "She was in the botnet already",
            "Was denied after third enrollment showed false information",
            "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
            "Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
            "Tsara was unable to finish her second degree this way. But found a way.",
            "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
            "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
            "Many pulses are missing. When we first began using this tool PIT was what we researched first",
            "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
            "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
            "She refused. Two weeks later  man is parked outside of her residence in a different county and city.",
            "I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
            "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
            "Lots of detail because someone , somewhere is going through this."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Win32:RansomX-gen\\ [Ransom]",
              "display_name": "Win32:RansomX-gen\\ [Ransom]",
              "target": null
            },
            {
              "id": "ELF:Mirai-AAL\\ [Trj]",
              "display_name": "ELF:Mirai-AAL\\ [Trj]",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1553.001",
              "name": "Gatekeeper Bypass",
              "display_name": "T1553.001 - Gatekeeper Bypass"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 5,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1037,
            "domain": 161,
            "hostname": 340,
            "email": 2,
            "FileHash-SHA256": 315,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 20,
            "CIDR": 16,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 1913,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "83 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695043197c2fbfda85abc1d4",
          "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
          "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
          "modified": "2025-12-27T20:35:37.012000",
          "created": "2025-12-27T20:35:37.012000",
          "tags": [
            "Palantir",
            "Ad- Maven",
            "Prometheus Intelligence Technology"
          ],
          "references": [
            "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
            "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Carts.Guru",
              "display_name": "Carts.Guru",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Government",
            "Education",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 82,
            "hostname": 180,
            "URL": 995,
            "FileHash-SHA256": 110
          },
          "indicator_count": 1367,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "113 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688716977e80a4274f2eafa9",
          "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
          "description": "Found in Bot joining Pulse.",
          "modified": "2025-08-27T06:03:05.020000",
          "created": "2025-07-28T06:20:07.660000",
          "tags": [
            "present jul",
            "united",
            "entries",
            "search",
            "moved",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "body",
            "meta",
            "passive dns",
            "next associated",
            "win32spigot apr",
            "title error",
            "ipv4 add",
            "pulse pulses",
            "urls",
            "files",
            "adaptivebee",
            "worm",
            "win32",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "location united",
            "asn asnone",
            "nameservers",
            "less whois",
            "registrar",
            "csc corporate",
            "status",
            "servers",
            "name servers",
            "hostname",
            "hostname add",
            "a domains",
            "script urls",
            "unknown aaaa",
            "technology one",
            "script script",
            "certificate",
            "null",
            "trojan",
            "twitter",
            "domain",
            "files ip",
            "address domain",
            "ip related",
            "pulses otx",
            "virtool",
            "http",
            "present jun",
            "present may",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "australia asn",
            "as55532 squiz",
            "dns resolutions",
            "overview ip",
            "address",
            "ipv4",
            "iocs",
            "data upload",
            "extraction",
            "ided iocs",
            "failed",
            "shaw",
            "ail tvnas",
            "rl irl",
            "domain add",
            "ostname add",
            "verdict",
            "show",
            "types",
            "type",
            "indicator data",
            "searc type",
            "a indicator",
            "data",
            "select across",
            "all pages",
            "domain domain",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "msie",
            "chrome",
            "present dec",
            "base",
            "read c",
            "port",
            "destination",
            "delete",
            "copy",
            "write",
            "memcommit",
            "cryptexportkey",
            "invalid pointer",
            "writeconsolea",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "size",
            "ascii text",
            "crlf line",
            "mitre att",
            "error",
            "click",
            "hybrid",
            "local",
            "path",
            "starfield",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "form",
            "adversaries",
            "windows nt",
            "generic http",
            "exe upload",
            "inbound",
            "outbound",
            "yara detections",
            "malware",
            "expiration date",
            "whois show",
            "name andrew",
            "bauer name",
            "div id",
            "beginstring",
            "beginerror",
            "script",
            "general",
            "cloud",
            "find",
            "footer",
            "ninite feb",
            "telper",
            "ninite mar",
            "ninite apr",
            "trojandropper",
            "mtb mar",
            "url https",
            "general full",
            "security tls",
            "software",
            "resource hash",
            "protocol h2",
            "frankfurt",
            "main",
            "germany",
            "input",
            "skype",
            "opciones",
            "july",
            "es form",
            "dom name",
            "post https",
            "imagen",
            "microsoft",
            "iniciar sesin",
            "value",
            "variables",
            "config",
            "debug",
            "loader",
            "geturl",
            "b function",
            "addlistener",
            "proof",
            "amazon02",
            "dk summary",
            "amazon rsa",
            "september",
            "browsing",
            "resource",
            "asn16509",
            "name value",
            "queueprogress",
            "timestamp input",
            "status actions"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 487,
            "FileHash-SHA1": 461,
            "URL": 10732,
            "domain": 1672,
            "email": 6,
            "hostname": 3039,
            "FileHash-SHA256": 2569,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 18973,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "235 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d91b1a8f414040bfba430",
          "name": "Spyware",
          "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
          "modified": "2025-08-20T00:01:59.498000",
          "created": "2025-07-21T01:02:41.049000",
          "tags": [
            "serving ip",
            "address",
            "status",
            "utc na",
            "utc google",
            "utc facebook",
            "custom audience",
            "tag manager",
            "ua748443502",
            "utc gtmwrp73mt",
            "utc gsrdlm5jnx1",
            "utc aw937838002",
            "adsense na",
            "connect",
            "file type",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "powershell",
            "b file",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "c0002 wininet",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cndigicert sha2",
            "secure server",
            "ca odigicert",
            "inc cus",
            "subject",
            "cnwe1 ogoogle",
            "trust",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft",
            "get http",
            "request",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "response",
            "united",
            "search",
            "creation date",
            "expiration date",
            "name servers",
            "unknown soa",
            "germany unknown",
            "entries",
            "pulse submit",
            "url analysis",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 304,
            "hostname": 796,
            "URL": 2590,
            "FileHash-SHA256": 2735,
            "FileHash-MD5": 253,
            "FileHash-SHA1": 144,
            "email": 1
          },
          "indicator_count": 6823,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
        "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
        "Lots of detail because someone , somewhere is going through this.",
        "She was in the botnet already",
        "We don\u2019t know how Octoseek & ScoreBlie (Team8)  became part of \u2018No Problems\u2019",
        "Old staff slow, foolish but eventually heeded instructions / once it was too late",
        "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
        "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
        "This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
        "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
        "Was denied after third enrollment showed false information",
        "Find a way to safely begin from a new server. Work from a Virtual World Class",
        "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
        "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
        "IDS Detections: TheMoon.linksys.router",
        "Many pulses are missing. When we first began using this tool PIT was what we researched first",
        "Palantir Extranet -https://prometheusintelligencetechnology.com/",
        "Dean is deceased?  Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
        "Tsara was unable to finish her second degree this way. But found a way.",
        "I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
        "Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
        "She refused. Two weeks later  man is parked outside of her residence in a different county and city.",
        "Tsara Brashears warned of hack, provided detailed information, provided advice",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse",
        "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
        "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
        "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
        "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Carts.guru",
            "Elf:mirai-aal\\ [trj]",
            "Win32:ransomx-gen\\ [ransom]",
            "Emotet",
            "Mirai"
          ],
          "industries": [
            "Civil society",
            "Education",
            "Government"
          ],
          "unique_indicators": 27911
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ad-maven.com",
    "whois": "http://whois.domaintools.com/ad-maven.com",
    "domain": "ad-maven.com",
    "hostname": "sentry.ad-maven.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "695035a98f01d94b2598f8ee",
      "name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University",
      "description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were  found. \n\nAll attacks immediately following assault.",
      "modified": "2026-01-26T18:04:20.395000",
      "created": "2025-12-27T19:38:17.198000",
      "tags": [
        "united",
        "unknown aaaa",
        "accept encoding",
        "moved",
        "urls",
        "files",
        "encrypt",
        "passive dns",
        "all ipv4",
        "america flag",
        "america asn",
        "ransom",
        "backdoor",
        "mtb win32",
        "mirai",
        "united states",
        "type indicator",
        "role title",
        "container",
        "ip address",
        "i div",
        "h2 p",
        "h4 p",
        "data",
        "desktop",
        "powerful",
        "url https",
        "url http",
        "indicator role",
        "active related",
        "cidr",
        "types",
        "indicators show",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "defense evasion",
        "spawns",
        "mitre att",
        "ck matrix",
        "command decode",
        "programfiles",
        "suricata ipv4",
        "windir",
        "comspec",
        "hybrid",
        "general",
        "path",
        "model",
        "click",
        "strings",
        "prometheus",
        "palantir",
        "kill list",
        "tracking",
        "moon linksys",
        "router",
        "emotet",
        "active",
        "regis university",
        "ascii text",
        "show technique",
        "pattern match",
        "sha1",
        "show process",
        "root",
        "local",
        "development att",
        "ssl certificate",
        "extranet",
        "maven"
      ],
      "references": [
        "Palantir Extranet -https://prometheusintelligencetechnology.com/",
        "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
        "IDS Detections: TheMoon.linksys.router",
        "We don\u2019t know how Octoseek & ScoreBlie (Team8)  became part of \u2018No Problems\u2019",
        "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
        "This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
        "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
        "Tsara Brashears warned of hack, provided detailed information, provided advice",
        "\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
        "Find a way to safely begin from a new server. Work from a Virtual World Class",
        "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
        "Old staff slow, foolish but eventually heeded instructions / once it was too late",
        "Dean is deceased?  Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
        "She was in the botnet already",
        "Was denied after third enrollment showed false information",
        "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
        "Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
        "Tsara was unable to finish her second degree this way. But found a way.",
        "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
        "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
        "Many pulses are missing. When we first began using this tool PIT was what we researched first",
        "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
        "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
        "She refused. Two weeks later  man is parked outside of her residence in a different county and city.",
        "I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
        "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
        "Lots of detail because someone , somewhere is going through this."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Win32:RansomX-gen\\ [Ransom]",
          "display_name": "Win32:RansomX-gen\\ [Ransom]",
          "target": null
        },
        {
          "id": "ELF:Mirai-AAL\\ [Trj]",
          "display_name": "ELF:Mirai-AAL\\ [Trj]",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1553.001",
          "name": "Gatekeeper Bypass",
          "display_name": "T1553.001 - Gatekeeper Bypass"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 5,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1037,
        "domain": 161,
        "hostname": 340,
        "email": 2,
        "FileHash-SHA256": 315,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 20,
        "CIDR": 16,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 1913,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "83 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695043197c2fbfda85abc1d4",
      "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
      "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
      "modified": "2025-12-27T20:35:37.012000",
      "created": "2025-12-27T20:35:37.012000",
      "tags": [
        "Palantir",
        "Ad- Maven",
        "Prometheus Intelligence Technology"
      ],
      "references": [
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Carts.Guru",
          "display_name": "Carts.Guru",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Government",
        "Education",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 82,
        "hostname": 180,
        "URL": 995,
        "FileHash-SHA256": 110
      },
      "indicator_count": 1367,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "113 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688716977e80a4274f2eafa9",
      "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
      "description": "Found in Bot joining Pulse.",
      "modified": "2025-08-27T06:03:05.020000",
      "created": "2025-07-28T06:20:07.660000",
      "tags": [
        "present jul",
        "united",
        "entries",
        "search",
        "moved",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "body",
        "meta",
        "passive dns",
        "next associated",
        "win32spigot apr",
        "title error",
        "ipv4 add",
        "pulse pulses",
        "urls",
        "files",
        "adaptivebee",
        "worm",
        "win32",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "location united",
        "asn asnone",
        "nameservers",
        "less whois",
        "registrar",
        "csc corporate",
        "status",
        "servers",
        "name servers",
        "hostname",
        "hostname add",
        "a domains",
        "script urls",
        "unknown aaaa",
        "technology one",
        "script script",
        "certificate",
        "null",
        "trojan",
        "twitter",
        "domain",
        "files ip",
        "address domain",
        "ip related",
        "pulses otx",
        "virtool",
        "http",
        "present jun",
        "present may",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "australia asn",
        "as55532 squiz",
        "dns resolutions",
        "overview ip",
        "address",
        "ipv4",
        "iocs",
        "data upload",
        "extraction",
        "ided iocs",
        "failed",
        "shaw",
        "ail tvnas",
        "rl irl",
        "domain add",
        "ostname add",
        "verdict",
        "show",
        "types",
        "type",
        "indicator data",
        "searc type",
        "a indicator",
        "data",
        "select across",
        "all pages",
        "domain domain",
        "checked url",
        "hostname server",
        "response ip",
        "address google",
        "safe browsing",
        "msie",
        "chrome",
        "present dec",
        "base",
        "read c",
        "port",
        "destination",
        "delete",
        "copy",
        "write",
        "memcommit",
        "cryptexportkey",
        "invalid pointer",
        "writeconsolea",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "size",
        "ascii text",
        "crlf line",
        "mitre att",
        "error",
        "click",
        "hybrid",
        "local",
        "path",
        "starfield",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "form",
        "adversaries",
        "windows nt",
        "generic http",
        "exe upload",
        "inbound",
        "outbound",
        "yara detections",
        "malware",
        "expiration date",
        "whois show",
        "name andrew",
        "bauer name",
        "div id",
        "beginstring",
        "beginerror",
        "script",
        "general",
        "cloud",
        "find",
        "footer",
        "ninite feb",
        "telper",
        "ninite mar",
        "ninite apr",
        "trojandropper",
        "mtb mar",
        "url https",
        "general full",
        "security tls",
        "software",
        "resource hash",
        "protocol h2",
        "frankfurt",
        "main",
        "germany",
        "input",
        "skype",
        "opciones",
        "july",
        "es form",
        "dom name",
        "post https",
        "imagen",
        "microsoft",
        "iniciar sesin",
        "value",
        "variables",
        "config",
        "debug",
        "loader",
        "geturl",
        "b function",
        "addlistener",
        "proof",
        "amazon02",
        "dk summary",
        "amazon rsa",
        "september",
        "browsing",
        "resource",
        "asn16509",
        "name value",
        "queueprogress",
        "timestamp input",
        "status actions"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 487,
        "FileHash-SHA1": 461,
        "URL": 10732,
        "domain": 1672,
        "email": 6,
        "hostname": 3039,
        "FileHash-SHA256": 2569,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 18973,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "235 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d91b1a8f414040bfba430",
      "name": "Spyware",
      "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
      "modified": "2025-08-20T00:01:59.498000",
      "created": "2025-07-21T01:02:41.049000",
      "tags": [
        "serving ip",
        "address",
        "status",
        "utc na",
        "utc google",
        "utc facebook",
        "custom audience",
        "tag manager",
        "ua748443502",
        "utc gtmwrp73mt",
        "utc gsrdlm5jnx1",
        "utc aw937838002",
        "adsense na",
        "connect",
        "file type",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "powershell",
        "b file",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "c0002 wininet",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cndigicert sha2",
        "secure server",
        "ca odigicert",
        "inc cus",
        "subject",
        "cnwe1 ogoogle",
        "trust",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft",
        "get http",
        "request",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "response",
        "united",
        "search",
        "creation date",
        "expiration date",
        "name servers",
        "unknown soa",
        "germany unknown",
        "entries",
        "pulse submit",
        "url analysis",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 304,
        "hostname": 796,
        "URL": 2590,
        "FileHash-SHA256": 2735,
        "FileHash-MD5": 253,
        "FileHash-SHA1": 144,
        "email": 1
      },
      "indicator_count": 6823,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://sentry.ad-maven.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://sentry.ad-maven.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641444.4909525
}