{
"type": "URL",
"indicator": "https://status.jianqun.me",
"general": {
"sections": [
"general",
"url_list",
"http_scans",
"screenshot"
],
"indicator": "https://status.jianqun.me",
"type": "url",
"type_title": "URL",
"validation": [],
"base_indicator": {
"id": 4123993017,
"indicator": "https://status.jianqun.me",
"type": "URL",
"title": "",
"description": "",
"content": "",
"access_type": "public",
"access_reason": ""
},
"pulse_info": {
"count": 7,
"pulses": [
{
"id": "695035a98f01d94b2598f8ee",
"name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University",
"description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were found. \n\nAll attacks immediately following assault.",
"modified": "2026-01-26T18:04:20.395000",
"created": "2025-12-27T19:38:17.198000",
"tags": [
"united",
"unknown aaaa",
"accept encoding",
"moved",
"urls",
"files",
"encrypt",
"passive dns",
"all ipv4",
"america flag",
"america asn",
"ransom",
"backdoor",
"mtb win32",
"mirai",
"united states",
"type indicator",
"role title",
"container",
"ip address",
"i div",
"h2 p",
"h4 p",
"data",
"desktop",
"powerful",
"url https",
"url http",
"indicator role",
"active related",
"cidr",
"types",
"indicators show",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"command",
"adversaries",
"defense evasion",
"spawns",
"mitre att",
"ck matrix",
"command decode",
"programfiles",
"suricata ipv4",
"windir",
"comspec",
"hybrid",
"general",
"path",
"model",
"click",
"strings",
"prometheus",
"palantir",
"kill list",
"tracking",
"moon linksys",
"router",
"emotet",
"active",
"regis university",
"ascii text",
"show technique",
"pattern match",
"sha1",
"show process",
"root",
"local",
"development att",
"ssl certificate",
"extranet",
"maven"
],
"references": [
"Palantir Extranet -https://prometheusintelligencetechnology.com/",
"Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
"IDS Detections: TheMoon.linksys.router",
"We don\u2019t know how Octoseek & ScoreBlie (Team8) became part of \u2018No Problems\u2019",
"It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
"This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
"Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
"Tsara Brashears warned of hack, provided detailed information, provided advice",
"\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
"Find a way to safely begin from a new server. Work from a Virtual World Class",
"Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
"Old staff slow, foolish but eventually heeded instructions / once it was too late",
"Dean is deceased? Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
"She was in the botnet already",
"Was denied after third enrollment showed false information",
"She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
"Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
"Tsara was unable to finish her second degree this way. But found a way.",
"I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
"Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
"Many pulses are missing. When we first began using this tool PIT was what we researched first",
"This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
"One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
"She refused. Two weeks later man is parked outside of her residence in a different county and city.",
"I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
"This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
"Lots of detail because someone , somewhere is going through this."
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "Mirai",
"display_name": "Mirai",
"target": null
},
{
"id": "Win32:RansomX-gen\\ [Ransom]",
"display_name": "Win32:RansomX-gen\\ [Ransom]",
"target": null
},
{
"id": "ELF:Mirai-AAL\\ [Trj]",
"display_name": "ELF:Mirai-AAL\\ [Trj]",
"target": null
},
{
"id": "Emotet",
"display_name": "Emotet",
"target": null
}
],
"attack_ids": [
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1129",
"name": "Shared Modules",
"display_name": "T1129 - Shared Modules"
},
{
"id": "T1203",
"name": "Exploitation for Client Execution",
"display_name": "T1203 - Exploitation for Client Execution"
},
{
"id": "T1518",
"name": "Software Discovery",
"display_name": "T1518 - Software Discovery"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1583.005",
"name": "Botnet",
"display_name": "T1583.005 - Botnet"
},
{
"id": "T1553.001",
"name": "Gatekeeper Bypass",
"display_name": "T1553.001 - Gatekeeper Bypass"
},
{
"id": "T1568.002",
"name": "Domain Generation Algorithms",
"display_name": "T1568.002 - Domain Generation Algorithms"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1518.001",
"name": "Security Software Discovery",
"display_name": "T1518.001 - Security Software Discovery"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 4,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 5,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 1037,
"domain": 161,
"hostname": 340,
"email": 2,
"FileHash-SHA256": 315,
"FileHash-MD5": 14,
"FileHash-SHA1": 20,
"CIDR": 16,
"SSLCertFingerprint": 8
},
"indicator_count": 1913,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 142,
"modified_text": "125 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68e2bb5d9ee8577ab5519f2c",
"name": "Meritshealth with DoD links? ",
"description": "",
"modified": "2026-01-13T00:05:56.401000",
"created": "2025-10-05T18:39:25.286000",
"tags": [
"gtmk5nxqc6",
"utc amazon",
"utc na",
"acceptencoding",
"gmt contenttype",
"connection",
"true pragma",
"gmt setcookie",
"httponly",
"gmt vary",
"nc000000 up",
"html document",
"unicode text",
"utf8 text",
"oc0006 http",
"http traffic",
"https http",
"mitre att",
"control ta0011",
"protocol t1071",
"match info",
"t1573 severity",
"info",
"number",
"ja3s",
"algorithm",
"azure rsa",
"tls issuing",
"cus subject",
"stwa lredmond",
"cnmicrosoft ecc",
"update secure",
"server ca",
"omicrosoft cus",
"get http",
"dns resolutions",
"registrar",
"markmonitor inc",
"country",
"resolver domain",
"type name",
"html",
"apnic",
"apnic whois",
"please",
"rirs",
"cidr",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"command",
"adversaries",
"development att",
"name tactics",
"binary file",
"ck matrix",
"wheelchair",
"iamrobert",
"pattern match",
"ascii text",
"href",
"united",
"general",
"local",
"path",
"encrypt",
"click",
"passive dns",
"urls",
"files",
"reverse dns",
"netherlands",
"present aug",
"a domains",
"moved",
"first pqc",
"ip address",
"unknown ns",
"unknown aaaa",
"title",
"body",
"meta",
"window",
"accept",
"body doctype",
"welcome",
"ok server",
"gmt content",
"present jul",
"present sep",
"aaaa",
"hostname",
"error",
"defense evasion",
"windows nt",
"response",
"vary",
"strings",
"core",
"t1027.013 encrypted/encoded",
"michelin lazy k",
"prefetch8",
"flag",
"date",
"starfield",
"hybrid",
"mobility cr",
"extraction",
"data upload",
"include",
"o url",
"url url",
"included i0",
"review ioc",
"excluded ic",
"suggested",
"find sugi",
"failed",
"cre pul",
"enter",
"enter sc",
"type",
"enric",
"extra",
"type opaste",
"data u",
"included",
"copy md5",
"copy sha1",
"copy sha256",
"null",
"refresh",
"tools",
"look",
"verify",
"restart",
"t1480 execution",
"expiration",
"url https",
"no expiration",
"iocs",
"ipv4",
"text drag",
"drop or",
"browse to",
"select file",
"redacted for",
"server",
"privacy tech",
"privacy admin",
"postal code",
"stateprovince",
"organization",
"email",
"code",
"quantum rooms",
"sam somalia",
"emp",
"porn",
"media defense",
"gov porn",
"suck my nips",
"reimer suspect",
"jeffrey reimer",
"dod",
"department of defense",
"show",
"date checked",
"url hostname",
"server response",
"google safe",
"results may",
"entries http",
"scans record",
"value status",
"sabey type",
"merits fake",
"y.a.s.",
"pornography",
"ramsom"
],
"references": [
"https://www.meritshealth.com/ Defense.Gov Mobility Co? ",
"zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
"https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
"https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
"https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
"https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com",
"https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
"https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
"https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
"https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
"https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members",
"https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210",
"https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
"https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
"https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo",
"https://meumundogay-com.sexogratis.page/locker",
"https://es.pornhat.com/models/the-sex-creator/",
"Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
"Can the DoD no questions asked target a SA victim",
"Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
"There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
"socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
"There is fear in silence or speaking out",
"Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
"3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
"If someone is believed to be a threat they have right to due process.",
"Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
"She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
"Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
"Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
"ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
"iamrobert.com Y.A.S.",
"1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam",
"Target agreed and complied with all lie detector measures.",
"Is the family allowed to have a funeral for Tsara or print an obituary",
"No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
"I am very upset. Whoever is doing this is sick."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "APNIC",
"display_name": "APNIC",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
}
],
"attack_ids": [
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1573",
"name": "Encrypted Channel",
"display_name": "T1573 - Encrypted Channel"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1069.002",
"name": "Domain Groups",
"display_name": "T1069.002 - Domain Groups"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1583.001",
"name": "Domains",
"display_name": "T1583.001 - Domains"
},
{
"id": "TA0042",
"name": "Resource Development",
"display_name": "TA0042 - Resource Development"
},
{
"id": "TA0005",
"name": "Defense Evasion",
"display_name": "TA0005 - Defense Evasion"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1528",
"name": "Steal Application Access Token",
"display_name": "T1528 - Steal Application Access Token"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1132",
"name": "Data Encoding",
"display_name": "T1132 - Data Encoding"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1457",
"name": "Malicious Media Content",
"display_name": "T1457 - Malicious Media Content"
},
{
"id": "T1562.001",
"name": "Disable or Modify Tools",
"display_name": "T1562.001 - Disable or Modify Tools"
},
{
"id": "T1562.004",
"name": "Disable or Modify System Firewall",
"display_name": "T1562.004 - Disable or Modify System Firewall"
},
{
"id": "T1089",
"name": "Disabling Security Tools",
"display_name": "T1089 - Disabling Security Tools"
},
{
"id": "T1562.008",
"name": "Disable Cloud Logs",
"display_name": "T1562.008 - Disable Cloud Logs"
},
{
"id": "T1125",
"name": "Video Capture",
"display_name": "T1125 - Video Capture"
},
{
"id": "T1056.003",
"name": "Web Portal Capture",
"display_name": "T1056.003 - Web Portal Capture"
},
{
"id": "T1512",
"name": "Capture Camera",
"display_name": "T1512 - Capture Camera"
},
{
"id": "T1180",
"name": "Screensaver",
"display_name": "T1180 - Screensaver"
}
],
"industries": [],
"TLP": "white",
"cloned_from": "68e2b14d83bb63502feac65e",
"export_count": 17,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"domain": 1365,
"URL": 11172,
"hostname": 2780,
"FileHash-MD5": 381,
"FileHash-SHA256": 4420,
"FileHash-SHA1": 338,
"CIDR": 4,
"SSLCertFingerprint": 24,
"CVE": 1,
"email": 1
},
"indicator_count": 20486,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "139 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68e2b14d83bb63502feac65e",
"name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
"description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech needed. Later denies ever being a mobility technician. They killed a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
"modified": "2026-01-07T00:00:30.717000",
"created": "2025-10-05T17:56:29.109000",
"tags": [
"gtmk5nxqc6",
"utc amazon",
"utc na",
"acceptencoding",
"gmt contenttype",
"connection",
"true pragma",
"gmt setcookie",
"httponly",
"gmt vary",
"nc000000 up",
"html document",
"unicode text",
"utf8 text",
"oc0006 http",
"http traffic",
"https http",
"mitre att",
"control ta0011",
"protocol t1071",
"match info",
"t1573 severity",
"info",
"number",
"ja3s",
"algorithm",
"azure rsa",
"tls issuing",
"cus subject",
"stwa lredmond",
"cnmicrosoft ecc",
"update secure",
"server ca",
"omicrosoft cus",
"get http",
"dns resolutions",
"registrar",
"markmonitor inc",
"country",
"resolver domain",
"type name",
"html",
"apnic",
"apnic whois",
"please",
"rirs",
"cidr",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"command",
"adversaries",
"development att",
"name tactics",
"binary file",
"ck matrix",
"wheelchair",
"iamrobert",
"pattern match",
"ascii text",
"href",
"united",
"general",
"local",
"path",
"encrypt",
"click",
"passive dns",
"urls",
"files",
"reverse dns",
"netherlands",
"present aug",
"a domains",
"moved",
"first pqc",
"ip address",
"unknown ns",
"unknown aaaa",
"title",
"body",
"meta",
"window",
"accept",
"body doctype",
"welcome",
"ok server",
"gmt content",
"present jul",
"present sep",
"aaaa",
"hostname",
"error",
"defense evasion",
"windows nt",
"response",
"vary",
"strings",
"core",
"t1027.013 encrypted/encoded",
"michelin lazy k",
"prefetch8",
"flag",
"date",
"starfield",
"hybrid",
"mobility cr",
"extraction",
"data upload",
"include",
"o url",
"url url",
"included i0",
"review ioc",
"excluded ic",
"suggested",
"find sugi",
"failed",
"cre pul",
"enter",
"enter sc",
"type",
"enric",
"extra",
"type opaste",
"data u",
"included",
"copy md5",
"copy sha1",
"copy sha256",
"null",
"refresh",
"tools",
"look",
"verify",
"restart",
"t1480 execution",
"expiration",
"url https",
"no expiration",
"iocs",
"ipv4",
"text drag",
"drop or",
"browse to",
"select file",
"redacted for",
"server",
"privacy tech",
"privacy admin",
"postal code",
"stateprovince",
"organization",
"email",
"code",
"quantum rooms",
"sam somalia",
"emp",
"porn",
"media defense",
"gov porn",
"suck my nips",
"reimer suspect",
"jeffrey reimer",
"dod",
"department of defense",
"show",
"date checked",
"url hostname",
"server response",
"google safe",
"results may",
"entries http",
"scans record",
"value status",
"sabey type",
"merits fake",
"y.a.s.",
"pornography",
"ramsom"
],
"references": [
"https://www.meritshealth.com/ Defense.Gov Mobility Co? ",
"zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
"https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
"https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
"https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
"https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com",
"https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
"https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
"https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
"https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
"https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members",
"https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210",
"https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
"https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
"https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo",
"https://meumundogay-com.sexogratis.page/locker",
"https://es.pornhat.com/models/the-sex-creator/",
"Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
"Can the DoD no questions asked target a SA victim",
"Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
"There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
"socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
"There is fear in silence or speaking out",
"Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
"3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
"If someone is believed to be a threat they have right to due process.",
"Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
"She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
"Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
"Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
"ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
"iamrobert.com Y.A.S.",
"1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam",
"Target agreed and complied with all lie detector measures.",
"Is the family allowed to have a funeral for Tsara or print an obituary",
"No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
"I am very upset. Whoever is doing this is sick."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "APNIC",
"display_name": "APNIC",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
}
],
"attack_ids": [
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1573",
"name": "Encrypted Channel",
"display_name": "T1573 - Encrypted Channel"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1069.002",
"name": "Domain Groups",
"display_name": "T1069.002 - Domain Groups"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1583.001",
"name": "Domains",
"display_name": "T1583.001 - Domains"
},
{
"id": "TA0042",
"name": "Resource Development",
"display_name": "TA0042 - Resource Development"
},
{
"id": "TA0005",
"name": "Defense Evasion",
"display_name": "TA0005 - Defense Evasion"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1528",
"name": "Steal Application Access Token",
"display_name": "T1528 - Steal Application Access Token"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1132",
"name": "Data Encoding",
"display_name": "T1132 - Data Encoding"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1457",
"name": "Malicious Media Content",
"display_name": "T1457 - Malicious Media Content"
},
{
"id": "T1562.001",
"name": "Disable or Modify Tools",
"display_name": "T1562.001 - Disable or Modify Tools"
},
{
"id": "T1562.004",
"name": "Disable or Modify System Firewall",
"display_name": "T1562.004 - Disable or Modify System Firewall"
},
{
"id": "T1089",
"name": "Disabling Security Tools",
"display_name": "T1089 - Disabling Security Tools"
},
{
"id": "T1562.008",
"name": "Disable Cloud Logs",
"display_name": "T1562.008 - Disable Cloud Logs"
},
{
"id": "T1125",
"name": "Video Capture",
"display_name": "T1125 - Video Capture"
},
{
"id": "T1056.003",
"name": "Web Portal Capture",
"display_name": "T1056.003 - Web Portal Capture"
},
{
"id": "T1512",
"name": "Capture Camera",
"display_name": "T1512 - Capture Camera"
},
{
"id": "T1180",
"name": "Screensaver",
"display_name": "T1180 - Screensaver"
}
],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 11,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 1,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"domain": 1328,
"URL": 9931,
"hostname": 2621,
"FileHash-MD5": 381,
"FileHash-SHA256": 4360,
"FileHash-SHA1": 338,
"CIDR": 4,
"SSLCertFingerprint": 24,
"CVE": 1,
"email": 1
},
"indicator_count": 18989,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "145 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6923408464566e39caf32285",
"name": "Discord- DNS | Malvertizing | Ransom/Msilzilla (sifting IoC\u2019s created by scnrscnr)",
"description": "TAGS\nActive\n443 ma2592000\nChristopher Pool\nPool's Closed\nTimothy Pool\na li\n google\namerica att\napache\napache ip\nasn as46606\nauditmode force\nbehavior\nbinary\nbinary file\nbk role\nchat\ncheck\nchrome\nck ids\ncommon stealer\ncookie\ndata upload\ndefender\ndelete c\ndirectui\ndiscord\ndns lookup\ndomain add\ndrop\ndynamicloader\neb d8\nee fc\nerror oct\nexplorer\nexternal ip\nextraction\nf0 ff\nfailed\nff bb\nff d5\nff ff\nfiles\nfoundry\ngmt content\ngmt etag\ngmt server\ngoogle chrome\nguard\nhigh\ninsert\nlolminer\nmalware\nmedia\nmeta\nmoved\nmovie\nmsie\nmsvisualbasic60\nmtb aug -present \nneversend\npowershell\nrelated nids\nresponse ip\nself\nservice domain\nsingapore\nsmartassembly\nspan\nspan a\nsx08x00x00a\ntargeting\ntls sni\ntrojan\ntrojandropper\ntwitter\ntx08x00x00n\nunique\nuser agent\nux08x00x00h\nvirtool\nvirustotal api\nvoice\nvx08x00x00j\nwrite\nwrite c\nwx08x00x00\nx08x00x00b\nx08x00x00x00\nyara\nyara rule\nyx08x00x00l\nz3je\nz3uwq7\nzx08x00x00",
"modified": "2025-12-23T16:04:54.329000",
"created": "2025-11-23T17:12:36.917000",
"tags": [
"no expiration",
"expiration",
"url https",
"url http",
"filehashsha256",
"hostname",
"domain",
"filehashmd5",
"filehashsha1",
"ipv4",
"code",
"pool",
"timothy pool",
"z3je z3uwq7",
"creation date",
"ip address",
"emails",
"expiration date",
"status",
"hostname add",
"pulse pulses",
"passive dns",
"urls",
"date"
],
"references": [
"https://otx.alienvault.com/pulse/5fa57698ac0f6638b7b9a8ba",
"Examining pulse created by scnrscnr is worth reviewing. I was surprised tonal see a targets name.I didn\u2019t see Foundry highlighted",
"http://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com",
"https://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com \u2022 www.techcult.com/judge-the-simpsons-parody-is-child-pornography/ Whitelisted domain techcult.com\t Domain blogspot.com Whitelisted domain blogspot.com\t Domain techcult.com Whitelisted domain techcult.com\t Hostname aninditaannisa.blogspot.com \u2022 domain blogspot.com",
"www.techcult.com",
"http://foundry.tartarynova.com phishing \u2022 https://foundry.tartarynova.com \u2022 foundry.tartarynova.com",
"https://trail.truefoundry.com/api/t/c/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE/enc_U2FsdGVkX1_wWHRx9nPGCEspZpUcIwc1yphMTxaaQ2ZAbsxOqRR4ibXcaYtcmgJ1UgabTFCHVVBLx2oAnBAW2h8el_edjHN72Ug0yKQePjKnSJEOnQvtq8MUPo0vkU1N",
"https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_L9bYYgL2HGng9mDsC",
"https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE",
"truefoundry.com \u2022 assets.production.truefoundry.com \u2022 cpt.llm-gateway.truefoundry.com",
"yyz.llm-gateway.truefoundry.com \u2022 trail.truefoundry.com \u2022 sin.llm-gateway.truefoundry.com",
"lm-gateway.truefoundry.com \u2022 https://assets.production.truefoundry.com/sample-openapi.json",
"162.159.128.233 \u2022 http://tsar.vicly.org \u2022 https://tsar.vicly.org \u2022 tsar.vicly.org \u2022 vicly.org \u2022 https://tsar.vicly.org/",
"http://scteamcommunity.com/4k-high-res-porn-videos/squirt phishing",
"http://pic.porn.hub-accessories.site \u2022 https://pic.porn.hub-accessories.site \u2022 pic.porn.hub-accessories.site",
"2022ww11.pornhubgsy.com \u2022 http://scteamcommunity.com/4k-high-res-porn-videos/squirt",
"IDS Detections: Observed Discord Domain in DNS Lookup (discord .com) Discord Chat Service Domain in DNS Lookup (discord .com)",
"IDS Detections: Observed Discord Domain (discord .com in TLS SNI)",
"IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"IDS Detections: Observed Discord Domain (discordapp .com in TLS SNI) Observed Discord Service Domain (discord .com) in TLS SNI Less",
"Yara: Detections ConventionEngine_Term_Users",
"Yara: ConventionEngine_Anomaly_MultiPDB_Double , ConventionEngine_Term_Documents",
"Alerts: infostealer_browser infostealer_cookies binary_yara procmem_yara static_pe_anomaly",
"Alerts: pe_compile_timestomping antiav_detectfile antidebug_guardpages encrypted_ioc",
"Alerts: dynamic_function_loading injection_write_process reads_memory_remote_process",
"Alerts : network_cnc_https_generic reads_self packer_entropy injection_rwx uses_windows_utilities antivm_checks_available_memory queries_computer_name queries_user_name",
"Yara : MS_Visual_Basic_6_0 ,",
"Yara : UPX , Nrv2x , UPX_OEP_place , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser",
"Alerts : ransomware_file_modifications stealth_file procmem_yara static_pe_anomaly",
"Alerts: disables_folder_options stealth_hidden_extension stealth_hiddenreg anomalous_deletefile",
"Alerts: mouse_movement_detect",
"Couldn\u2019t pulse 1st pulse so here\u2019s what\u2019s left",
"scnrscnr pulse is good. I\u2019m assuming they\u2019re targets.",
"Foundry stalking."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "TrojanDropper:Win32/VB.IL0",
"display_name": "TrojanDropper:Win32/VB.IL0",
"target": "/malware/TrojanDropper:Win32/VB.IL0"
},
{
"id": "ALF:Trojan:Win32/Cassini_56a3061!ibt",
"display_name": "ALF:Trojan:Win32/Cassini_56a3061!ibt",
"target": null
},
{
"id": "Win.Ransomware.Msilzilla-10014498-0",
"display_name": "Win.Ransomware.Msilzilla-10014498-0",
"target": null
}
],
"attack_ids": [
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1119",
"name": "Automated Collection",
"display_name": "T1119 - Automated Collection"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "T1443",
"name": "Remotely Install Application",
"display_name": "T1443 - Remotely Install Application"
},
{
"id": "T1546",
"name": "Event Triggered Execution",
"display_name": "T1546 - Event Triggered Execution"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 7,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 773,
"FileHash-SHA1": 684,
"FileHash-SHA256": 1910,
"CVE": 2,
"SSLCertFingerprint": 4,
"URL": 3783,
"domain": 878,
"email": 7,
"hostname": 1913
},
"indicator_count": 9954,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "159 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68c62306c74c7f57dc993d13",
"name": "Predator - Dr. Jeffrey Reimer, DPT - Physical Therapist in Denver, CO | Healthgrades",
"description": "Malware with code overlap. JSR , DPT Health Grades account has been removed. An investigator claims Reimer & family have been moved, names , career , changes years ago, claims of government protection for him. After victims MRI JSR left town immediately. Returning in 2016 , coincidentally driving near victim location on various locations. \nIt\u2019s disgusting how technology is being used to cover up a crime instead of solve one.\n#code_overlap #malware #hosts_contacted\n#itstoolatetoapologizeitstoolate",
"modified": "2025-10-14T01:04:58.605000",
"created": "2025-09-14T02:05:58.793000",
"tags": [
"denver",
"jeffrey reimer",
"star rating",
"appointment",
"post",
"response are",
"listened",
"wait",
"reimer",
"healthgrades",
"reply flag",
"doctors",
"find",
"jeff",
"back",
"aurora",
"leave",
"crying",
"tips",
"tags na",
"utc scorecard",
"research beacon",
"utc yahoo",
"dot tags",
"united",
"mozilla",
"write c",
"nsisinetc",
"undetermined",
"medium",
"intel",
"ms windows",
"write",
"trojan",
"defender",
"delphi",
"win32",
"malware",
"win64",
"local",
"next",
"code overlap",
"dynamicloader",
"as15169",
"brazil as28604",
"brazil as396982",
"upatre",
"passive dns",
"title error",
"ipv4 add",
"pulse pulses",
"urls",
"files",
"reverse dns",
"location united",
"america flag",
"body",
"script script",
"powder sdk",
"a domains",
"title",
"script",
"certificate",
"hostname add",
"pulse submit",
"meta",
"learn",
"command",
"ck id",
"name tactics",
"suspicious",
"informative",
"spawns",
"evasion att",
"t1480 execution",
"signing defense",
"flag",
"whois privacy",
"service name",
"server",
"contacted hosts",
"ip address",
"process details",
"size",
"div id",
"beginstring",
"beginerror",
"null",
"error",
"strings",
"refresh",
"tools",
"onload",
"click",
"span",
"remote access"
],
"references": [
"#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler",
"YARA: Delphi This program must be run under Win32 compilers TrojanWin32Fakemalard Ujhhd",
"CodeOverlap | All malware listed exists",
"Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"All #tags auto populated.",
"URL http://virii.es/M/Mobile Malware Attacks and Defense.pdf",
"blog.manpowergroup.com.py (aww like dadvocates)",
"https://isexychat.com/chatrooms/teen-chat/with-others/\t (sounds about right)",
"r53lbr.run-delete-app-sa-east-1-1.run-delete-test-sa-east-1-9zt9rjv.forgeapps.ec2.aws.dev"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"display_name": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"target": null
},
{
"id": "Win.Malware.Tfuvtcog-7194372-0",
"display_name": "Win.Malware.Tfuvtcog-7194372-0",
"target": null
},
{
"id": "Trojan.Win32.Fakemalard",
"display_name": "Trojan.Win32.Fakemalard",
"target": null
},
{
"id": "Code Overlap",
"display_name": "Code Overlap",
"target": null
},
{
"id": "Trojan.Win32.Banload",
"display_name": "Trojan.Win32.Banload",
"target": null
},
{
"id": "Formbook",
"display_name": "Formbook",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [
"Medical",
"Media",
"Government."
],
"TLP": "white",
"cloned_from": null,
"export_count": 11,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"hostname": 609,
"URL": 1550,
"domain": 280,
"FileHash-SHA256": 1428,
"FileHash-MD5": 133,
"FileHash-SHA1": 115,
"SSLCertFingerprint": 4
},
"indicator_count": 4119,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "230 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68c62316b24b23e6d4c579ef",
"name": "Predator - Dr. Jeffrey Reimer, DPT - Physical Therapist in Denver, CO | Healthgrades",
"description": "Malware with code overlap. JSR , DPT Health Grades account has been removed. An investigator claims Reimer & family have been moved, names , career , changes years ago, claims of government protection for him. After victims MRI JSR left town immediately. Returning in 2016 , coincidentally driving near victim location on various locations. \nIt\u2019s disgusting how technology is being used to cover up a crime instead of solve one.\n#code_overlap #malware #hosts_contacted\n#itstoolatetoapologizeitstoolate",
"modified": "2025-10-14T01:04:58.605000",
"created": "2025-09-14T02:06:14.853000",
"tags": [
"denver",
"jeffrey reimer",
"star rating",
"appointment",
"post",
"response are",
"listened",
"wait",
"reimer",
"healthgrades",
"reply flag",
"doctors",
"find",
"jeff",
"back",
"aurora",
"leave",
"crying",
"tips",
"tags na",
"utc scorecard",
"research beacon",
"utc yahoo",
"dot tags",
"united",
"mozilla",
"write c",
"nsisinetc",
"undetermined",
"medium",
"intel",
"ms windows",
"write",
"trojan",
"defender",
"delphi",
"win32",
"malware",
"win64",
"local",
"next",
"code overlap",
"dynamicloader",
"as15169",
"brazil as28604",
"brazil as396982",
"upatre",
"passive dns",
"title error",
"ipv4 add",
"pulse pulses",
"urls",
"files",
"reverse dns",
"location united",
"america flag",
"body",
"script script",
"powder sdk",
"a domains",
"title",
"script",
"certificate",
"hostname add",
"pulse submit",
"meta",
"learn",
"command",
"ck id",
"name tactics",
"suspicious",
"informative",
"spawns",
"evasion att",
"t1480 execution",
"signing defense",
"flag",
"whois privacy",
"service name",
"server",
"contacted hosts",
"ip address",
"process details",
"size",
"div id",
"beginstring",
"beginerror",
"null",
"error",
"strings",
"refresh",
"tools",
"onload",
"click",
"span",
"remote access"
],
"references": [
"#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler",
"YARA: Delphi This program must be run under Win32 compilers TrojanWin32Fakemalard Ujhhd",
"CodeOverlap | All malware listed exists",
"Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"All #tags auto populated.",
"URL http://virii.es/M/Mobile Malware Attacks and Defense.pdf",
"blog.manpowergroup.com.py (aww like dadvocates)",
"https://isexychat.com/chatrooms/teen-chat/with-others/\t (sounds about right)",
"r53lbr.run-delete-app-sa-east-1-1.run-delete-test-sa-east-1-9zt9rjv.forgeapps.ec2.aws.dev"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"display_name": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"target": null
},
{
"id": "Win.Malware.Tfuvtcog-7194372-0",
"display_name": "Win.Malware.Tfuvtcog-7194372-0",
"target": null
},
{
"id": "Trojan.Win32.Fakemalard",
"display_name": "Trojan.Win32.Fakemalard",
"target": null
},
{
"id": "Code Overlap",
"display_name": "Code Overlap",
"target": null
},
{
"id": "Trojan.Win32.Banload",
"display_name": "Trojan.Win32.Banload",
"target": null
},
{
"id": "Formbook",
"display_name": "Formbook",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
},
{
"id": "Too much to search for",
"display_name": "Too much to search for",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [
"Medical",
"Media",
"Government."
],
"TLP": "white",
"cloned_from": null,
"export_count": 9,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"hostname": 609,
"URL": 1550,
"domain": 280,
"FileHash-SHA256": 1428,
"FileHash-MD5": 133,
"FileHash-SHA1": 115,
"SSLCertFingerprint": 4
},
"indicator_count": 4119,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "230 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68ac1823eed9568e26950b98",
"name": "ELF: Mirai - Malicious media | sentient.industries | Palantir",
"description": "Malicious entity weaponizing AI and next level cyber attacks, targeting, hacking, espionage, tracking, bad traffic, botnet, honeypots, bots , ddos. \n\nIt\u2019s really easy to become a target. Protest a cause, become a victim of crime by someone protected by a major entity , incur a large loss insurance case or have a high profile potential lawsuit on and on\u2026 \n\nExcessive overreach, low accountability, no barrier to access, designed to be the cyber warfare weapon.\nIf this is a spoof and NOT Palantir which (but it is) still relentlessly , as malicious. You don\u2019t own your devices or privacy.\n\n#mustbestrangelyexitingtowatchthestoicsquirm",
"modified": "2025-09-24T07:05:04.439000",
"created": "2025-08-25T08:00:35.492000",
"tags": [
"sentientindustries",
"adult",
"pornography",
"targeting",
"content reputation",
"palantirfoundry",
"palantir",
"malicious media",
"tool",
"abuse",
"citizens",
"gay",
"united",
"cache control",
"access control",
"passive dns",
"ip address",
"body found",
"gmt content",
"express cache",
"accept",
"pragma",
"avast avg",
"mirai",
"games",
"aniporn",
"eporner",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"adversaries",
"command",
"javascript",
"defense evasion",
"spawns",
"attrib",
"extid",
"fbid",
"creatortool",
"pattern match",
"date",
"path",
"august",
"hybrid",
"general",
"click",
"strings",
"bham",
"this",
"core",
"unknown aaaa",
"moved",
"unknown ns",
"body",
"h1 center",
"title",
"data upload",
"extraction",
"iocs",
"monitored target",
"copy md5",
"copy sha1",
"copy sha256",
"mitre att",
"show technique",
"ck matrix",
"span",
"possible",
"local",
"meta",
"roboto",
"supportscookie",
"spearphishing",
"initial access",
"ssl certificate",
"t1105",
"T1027.013 - Encrypted/Encoded File"
],
"references": [
"https://targeting-ai.com/dr-wisit-cheungpasitporn-invite-dhonneur-a-paris-pour-intelligence-artificielle-et-nephrologie-2025/ (phishing)",
"conf.targeting-ai.com \u2022 http://conf.targeting-ai.com \u2022 https://conf.targeting-ai.com \u2022 https://droidcall.cc/EQBhOSFz/",
"http://securityidiots.com/Web-Pentest/SQL-Injection/bypass-login-using-sql-injection.html",
"1-ai-chatbox-widget-2iv.pages.dev",
"FileleHash Sha256 [7a6da9fd351d428e9bfb8edbbca1275d9cdaf7f0371c77d2c227645509f7ebec ELF:Mirai-GH\\ [Trj] \u2022 Unix.Trojan.Gafgyt-6748839",
"Found in Palantirfoundry in sentient.indusutries linked to songculture.com (downed)",
"Redirecting to /verify/547062ef [URL https://eporner.blog \u2022 IPv4 104.21.3.107]",
"https://hayageek.com/drag-and-drop-file-upload-jquery",
"https://hayageek.com/rsa-encryption-decryption-openssl-c/",
"https://www-321chat-com.webpkgcache.com/doc/-/s/www.321chat.com/",
"https://www.melitta.be/portal/pics/layout/touchicons/apple-touch-icon-precomposed.png [Key-Systems GmbH]",
"https://hybrid-analysis.com/sample/627cf8e9a89c998bd5cb607854bbe31b82679c116b4e3834ff942220d61d3488/68ac1098bfa5002fad02e045",
"T1027.013 - Encrypted/Encoded File"
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "PornBlackmailer",
"display_name": "PornBlackmailer",
"target": null
},
{
"id": "Win32/PornTool",
"display_name": "Win32/PornTool",
"target": null
},
{
"id": "Mirai",
"display_name": "Mirai",
"target": null
},
{
"id": "ELF:Mirai-GH\\ [Trj]",
"display_name": "ELF:Mirai-GH\\ [Trj]",
"target": null
},
{
"id": "Unix.Trojan.Gafgyt-6748839",
"display_name": "Unix.Trojan.Gafgyt-6748839",
"target": null
},
{
"id": "supportsCookie",
"display_name": "supportsCookie",
"target": null
}
],
"attack_ids": [
{
"id": "T1457",
"name": "Malicious Media Content",
"display_name": "T1457 - Malicious Media Content"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1059",
"name": "Command and Scripting Interpreter",
"display_name": "T1059 - Command and Scripting Interpreter"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1083",
"name": "File and Directory Discovery",
"display_name": "T1083 - File and Directory Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1555",
"name": "Credentials from Password Stores",
"display_name": "T1555 - Credentials from Password Stores"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1608.005",
"name": "Link Target",
"display_name": "T1608.005 - Link Target"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1204",
"name": "User Execution",
"display_name": "T1204 - User Execution"
},
{
"id": "T1583.001",
"name": "Domains",
"display_name": "T1583.001 - Domains"
},
{
"id": "T1566.002",
"name": "Spearphishing Link",
"display_name": "T1566.002 - Spearphishing Link"
},
{
"id": "T1566.001",
"name": "Spearphishing Attachment",
"display_name": "T1566.001 - Spearphishing Attachment"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1568.002",
"name": "Domain Generation Algorithms",
"display_name": "T1568.002 - Domain Generation Algorithms"
},
{
"id": "T1532",
"name": "Data Encrypted",
"display_name": "T1532 - Data Encrypted"
}
],
"industries": [
"Telecommunications",
"Technology",
"Civilian Society",
"Government"
],
"TLP": "white",
"cloned_from": null,
"export_count": 16,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 966,
"domain": 222,
"hostname": 272,
"FileHash-MD5": 78,
"FileHash-SHA1": 84,
"FileHash-SHA256": 346,
"SSLCertFingerprint": 10
},
"indicator_count": 1978,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "249 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
}
],
"references": [
"scnrscnr pulse is good. I\u2019m assuming they\u2019re targets.",
"2022ww11.pornhubgsy.com \u2022 http://scteamcommunity.com/4k-high-res-porn-videos/squirt",
"Is the family allowed to have a funeral for Tsara or print an obituary",
"http://scteamcommunity.com/4k-high-res-porn-videos/squirt phishing",
"Yara: ConventionEngine_Anomaly_MultiPDB_Double , ConventionEngine_Term_Documents",
"No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
"Yara: Detections ConventionEngine_Term_Users",
"iamrobert.com Y.A.S.",
"Target agreed and complied with all lie detector measures.",
"CodeOverlap | All malware listed exists",
"Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
"IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"Yara : MS_Visual_Basic_6_0 ,",
"One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
"This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
"Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
"http://foundry.tartarynova.com phishing \u2022 https://foundry.tartarynova.com \u2022 foundry.tartarynova.com",
"truefoundry.com \u2022 assets.production.truefoundry.com \u2022 cpt.llm-gateway.truefoundry.com",
"http://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com",
"Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
"Alerts: pe_compile_timestomping antiav_detectfile antidebug_guardpages encrypted_ioc",
"162.159.128.233 \u2022 http://tsar.vicly.org \u2022 https://tsar.vicly.org \u2022 tsar.vicly.org \u2022 vicly.org \u2022 https://tsar.vicly.org/",
"FileleHash Sha256 [7a6da9fd351d428e9bfb8edbbca1275d9cdaf7f0371c77d2c227645509f7ebec ELF:Mirai-GH\\ [Trj] \u2022 Unix.Trojan.Gafgyt-6748839",
"Foundry stalking.",
"It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
"Alerts: mouse_movement_detect",
"https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
"URL http://virii.es/M/Mobile Malware Attacks and Defense.pdf",
"T1027.013 - Encrypted/Encoded File",
"I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
"I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
"#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler",
"YARA: Delphi This program must be run under Win32 compilers TrojanWin32Fakemalard Ujhhd",
"blog.manpowergroup.com.py (aww like dadvocates)",
"Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
"https://targeting-ai.com/dr-wisit-cheungpasitporn-invite-dhonneur-a-paris-pour-intelligence-artificielle-et-nephrologie-2025/ (phishing)",
"Tsara was unable to finish her second degree this way. But found a way.",
"Find a way to safely begin from a new server. Work from a Virtual World Class",
"All #tags auto populated.",
"r53lbr.run-delete-app-sa-east-1-1.run-delete-test-sa-east-1-9zt9rjv.forgeapps.ec2.aws.dev",
"1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam",
"This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
"IDS Detections: Observed Discord Domain in DNS Lookup (discord .com) Discord Chat Service Domain in DNS Lookup (discord .com)",
"I am very upset. Whoever is doing this is sick.",
"Couldn\u2019t pulse 1st pulse so here\u2019s what\u2019s left",
"https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE",
"1-ai-chatbox-widget-2iv.pages.dev",
"http://pic.porn.hub-accessories.site \u2022 https://pic.porn.hub-accessories.site \u2022 pic.porn.hub-accessories.site",
"yyz.llm-gateway.truefoundry.com \u2022 trail.truefoundry.com \u2022 sin.llm-gateway.truefoundry.com",
"ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
"https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_L9bYYgL2HGng9mDsC",
"https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210",
"https://otx.alienvault.com/pulse/5fa57698ac0f6638b7b9a8ba",
"Tsara Brashears warned of hack, provided detailed information, provided advice",
"www.techcult.com",
"Alerts: infostealer_browser infostealer_cookies binary_yara procmem_yara static_pe_anomaly",
"https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
"Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
"Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
"IDS Detections: TheMoon.linksys.router",
"https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
"Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
"Many pulses are missing. When we first began using this tool PIT was what we researched first",
"zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
"https://meumundogay-com.sexogratis.page/locker",
"She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
"socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
"https://www-321chat-com.webpkgcache.com/doc/-/s/www.321chat.com/",
"https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
"Found in Palantirfoundry in sentient.indusutries linked to songculture.com (downed)",
"\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
"https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
"Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
"There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
"https://hayageek.com/drag-and-drop-file-upload-jquery",
"https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
"https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo",
"Alerts: disables_folder_options stealth_hidden_extension stealth_hiddenreg anomalous_deletefile",
"https://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com \u2022 www.techcult.com/judge-the-simpsons-parody-is-child-pornography/ Whitelisted domain techcult.com\t Domain blogspot.com Whitelisted domain blogspot.com\t Domain techcult.com Whitelisted domain techcult.com\t Hostname aninditaannisa.blogspot.com \u2022 domain blogspot.com",
"IDS Detections: Observed Discord Domain (discord .com in TLS SNI)",
"https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members",
"There is fear in silence or speaking out",
"Lots of detail because someone , somewhere is going through this.",
"Palantir Extranet -https://prometheusintelligencetechnology.com/",
"conf.targeting-ai.com \u2022 http://conf.targeting-ai.com \u2022 https://conf.targeting-ai.com \u2022 https://droidcall.cc/EQBhOSFz/",
"https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
"Examining pulse created by scnrscnr is worth reviewing. I was surprised tonal see a targets name.I didn\u2019t see Foundry highlighted",
"If someone is believed to be a threat they have right to due process.",
"https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
"This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
"https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
"https://www.meritshealth.com/ Defense.Gov Mobility Co? ",
"She was in the botnet already",
"https://hybrid-analysis.com/sample/627cf8e9a89c998bd5cb607854bbe31b82679c116b4e3834ff942220d61d3488/68ac1098bfa5002fad02e045",
"http://securityidiots.com/Web-Pentest/SQL-Injection/bypass-login-using-sql-injection.html",
"https://isexychat.com/chatrooms/teen-chat/with-others/\t (sounds about right)",
"Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
"Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
"https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com",
"Was denied after third enrollment showed false information",
"https://trail.truefoundry.com/api/t/c/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE/enc_U2FsdGVkX1_wWHRx9nPGCEspZpUcIwc1yphMTxaaQ2ZAbsxOqRR4ibXcaYtcmgJ1UgabTFCHVVBLx2oAnBAW2h8el_edjHN72Ug0yKQePjKnSJEOnQvtq8MUPo0vkU1N",
"Dean is deceased? Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
"IDS Detections: Observed Discord Domain (discordapp .com in TLS SNI) Observed Discord Service Domain (discord .com) in TLS SNI Less",
"3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
"Old staff slow, foolish but eventually heeded instructions / once it was too late",
"Alerts : ransomware_file_modifications stealth_file procmem_yara static_pe_anomaly",
"Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
"Alerts: dynamic_function_loading injection_write_process reads_memory_remote_process",
"Alerts : network_cnc_https_generic reads_self packer_entropy injection_rwx uses_windows_utilities antivm_checks_available_memory queries_computer_name queries_user_name",
"https://es.pornhat.com/models/the-sex-creator/",
"Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
"We don\u2019t know how Octoseek & ScoreBlie (Team8) became part of \u2018No Problems\u2019",
"lm-gateway.truefoundry.com \u2022 https://assets.production.truefoundry.com/sample-openapi.json",
"https://hayageek.com/rsa-encryption-decryption-openssl-c/",
"She refused. Two weeks later man is parked outside of her residence in a different county and city.",
"Yara : UPX , Nrv2x , UPX_OEP_place , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser",
"Can the DoD no questions asked target a SA victim",
"Redirecting to /verify/547062ef [URL https://eporner.blog \u2022 IPv4 104.21.3.107]",
"https://www.melitta.be/portal/pics/layout/touchicons/apple-touch-icon-precomposed.png [Key-Systems GmbH]"
],
"related": {
"alienvault": {
"adversary": [],
"malware_families": [],
"industries": [],
"unique_indicators": 0
},
"other": {
"adversary": [],
"malware_families": [
"Code overlap",
"Win32/porntool",
"Unix.trojan.gafgyt-6748839",
"Emotet",
"Too much to search for",
"Malware",
"Trojandropper:win32/vb.il0",
"Supportscookie",
"Pornblackmailer",
"#lowfi:aggregator:hasknownadwaredomain_nsisbundler.",
"Elf:mirai-gh\\ [trj]",
"Trojan.win32.banload",
"Apnic",
"Mirai",
"Win.malware.tfuvtcog-7194372-0",
"Trojan.win32.fakemalard",
"Win32:ransomx-gen\\ [ransom]",
"Alf:trojan:win32/cassini_56a3061!ibt",
"Elf:mirai-aal\\ [trj]",
"Formbook",
"Win.ransomware.msilzilla-10014498-0"
],
"industries": [
"Technology",
"Government.",
"Civilian society",
"Media",
"Medical",
"Government",
"Telecommunications"
],
"unique_indicators": 35862
}
}
},
"false_positive": [],
"alexa": "http://www.alexa.com/siteinfo/jianqun.me",
"whois": "http://whois.domaintools.com/jianqun.me",
"domain": "jianqun.me",
"hostname": "status.jianqun.me"
},
"geo": {},
"geo_ipapicom": {},
"pulse_count": 7,
"pulses": [
{
"id": "695035a98f01d94b2598f8ee",
"name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University",
"description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were found. \n\nAll attacks immediately following assault.",
"modified": "2026-01-26T18:04:20.395000",
"created": "2025-12-27T19:38:17.198000",
"tags": [
"united",
"unknown aaaa",
"accept encoding",
"moved",
"urls",
"files",
"encrypt",
"passive dns",
"all ipv4",
"america flag",
"america asn",
"ransom",
"backdoor",
"mtb win32",
"mirai",
"united states",
"type indicator",
"role title",
"container",
"ip address",
"i div",
"h2 p",
"h4 p",
"data",
"desktop",
"powerful",
"url https",
"url http",
"indicator role",
"active related",
"cidr",
"types",
"indicators show",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"command",
"adversaries",
"defense evasion",
"spawns",
"mitre att",
"ck matrix",
"command decode",
"programfiles",
"suricata ipv4",
"windir",
"comspec",
"hybrid",
"general",
"path",
"model",
"click",
"strings",
"prometheus",
"palantir",
"kill list",
"tracking",
"moon linksys",
"router",
"emotet",
"active",
"regis university",
"ascii text",
"show technique",
"pattern match",
"sha1",
"show process",
"root",
"local",
"development att",
"ssl certificate",
"extranet",
"maven"
],
"references": [
"Palantir Extranet -https://prometheusintelligencetechnology.com/",
"Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
"IDS Detections: TheMoon.linksys.router",
"We don\u2019t know how Octoseek & ScoreBlie (Team8) became part of \u2018No Problems\u2019",
"It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
"This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
"Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
"Tsara Brashears warned of hack, provided detailed information, provided advice",
"\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
"Find a way to safely begin from a new server. Work from a Virtual World Class",
"Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
"Old staff slow, foolish but eventually heeded instructions / once it was too late",
"Dean is deceased? Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
"She was in the botnet already",
"Was denied after third enrollment showed false information",
"She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
"Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
"Tsara was unable to finish her second degree this way. But found a way.",
"I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
"Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
"Many pulses are missing. When we first began using this tool PIT was what we researched first",
"This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
"One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
"She refused. Two weeks later man is parked outside of her residence in a different county and city.",
"I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
"This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
"Lots of detail because someone , somewhere is going through this."
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "Mirai",
"display_name": "Mirai",
"target": null
},
{
"id": "Win32:RansomX-gen\\ [Ransom]",
"display_name": "Win32:RansomX-gen\\ [Ransom]",
"target": null
},
{
"id": "ELF:Mirai-AAL\\ [Trj]",
"display_name": "ELF:Mirai-AAL\\ [Trj]",
"target": null
},
{
"id": "Emotet",
"display_name": "Emotet",
"target": null
}
],
"attack_ids": [
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1129",
"name": "Shared Modules",
"display_name": "T1129 - Shared Modules"
},
{
"id": "T1203",
"name": "Exploitation for Client Execution",
"display_name": "T1203 - Exploitation for Client Execution"
},
{
"id": "T1518",
"name": "Software Discovery",
"display_name": "T1518 - Software Discovery"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1583.005",
"name": "Botnet",
"display_name": "T1583.005 - Botnet"
},
{
"id": "T1553.001",
"name": "Gatekeeper Bypass",
"display_name": "T1553.001 - Gatekeeper Bypass"
},
{
"id": "T1568.002",
"name": "Domain Generation Algorithms",
"display_name": "T1568.002 - Domain Generation Algorithms"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1518.001",
"name": "Security Software Discovery",
"display_name": "T1518.001 - Security Software Discovery"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 4,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 5,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 1037,
"domain": 161,
"hostname": 340,
"email": 2,
"FileHash-SHA256": 315,
"FileHash-MD5": 14,
"FileHash-SHA1": 20,
"CIDR": 16,
"SSLCertFingerprint": 8
},
"indicator_count": 1913,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 142,
"modified_text": "125 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68e2bb5d9ee8577ab5519f2c",
"name": "Meritshealth with DoD links? ",
"description": "",
"modified": "2026-01-13T00:05:56.401000",
"created": "2025-10-05T18:39:25.286000",
"tags": [
"gtmk5nxqc6",
"utc amazon",
"utc na",
"acceptencoding",
"gmt contenttype",
"connection",
"true pragma",
"gmt setcookie",
"httponly",
"gmt vary",
"nc000000 up",
"html document",
"unicode text",
"utf8 text",
"oc0006 http",
"http traffic",
"https http",
"mitre att",
"control ta0011",
"protocol t1071",
"match info",
"t1573 severity",
"info",
"number",
"ja3s",
"algorithm",
"azure rsa",
"tls issuing",
"cus subject",
"stwa lredmond",
"cnmicrosoft ecc",
"update secure",
"server ca",
"omicrosoft cus",
"get http",
"dns resolutions",
"registrar",
"markmonitor inc",
"country",
"resolver domain",
"type name",
"html",
"apnic",
"apnic whois",
"please",
"rirs",
"cidr",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"command",
"adversaries",
"development att",
"name tactics",
"binary file",
"ck matrix",
"wheelchair",
"iamrobert",
"pattern match",
"ascii text",
"href",
"united",
"general",
"local",
"path",
"encrypt",
"click",
"passive dns",
"urls",
"files",
"reverse dns",
"netherlands",
"present aug",
"a domains",
"moved",
"first pqc",
"ip address",
"unknown ns",
"unknown aaaa",
"title",
"body",
"meta",
"window",
"accept",
"body doctype",
"welcome",
"ok server",
"gmt content",
"present jul",
"present sep",
"aaaa",
"hostname",
"error",
"defense evasion",
"windows nt",
"response",
"vary",
"strings",
"core",
"t1027.013 encrypted/encoded",
"michelin lazy k",
"prefetch8",
"flag",
"date",
"starfield",
"hybrid",
"mobility cr",
"extraction",
"data upload",
"include",
"o url",
"url url",
"included i0",
"review ioc",
"excluded ic",
"suggested",
"find sugi",
"failed",
"cre pul",
"enter",
"enter sc",
"type",
"enric",
"extra",
"type opaste",
"data u",
"included",
"copy md5",
"copy sha1",
"copy sha256",
"null",
"refresh",
"tools",
"look",
"verify",
"restart",
"t1480 execution",
"expiration",
"url https",
"no expiration",
"iocs",
"ipv4",
"text drag",
"drop or",
"browse to",
"select file",
"redacted for",
"server",
"privacy tech",
"privacy admin",
"postal code",
"stateprovince",
"organization",
"email",
"code",
"quantum rooms",
"sam somalia",
"emp",
"porn",
"media defense",
"gov porn",
"suck my nips",
"reimer suspect",
"jeffrey reimer",
"dod",
"department of defense",
"show",
"date checked",
"url hostname",
"server response",
"google safe",
"results may",
"entries http",
"scans record",
"value status",
"sabey type",
"merits fake",
"y.a.s.",
"pornography",
"ramsom"
],
"references": [
"https://www.meritshealth.com/ Defense.Gov Mobility Co? ",
"zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
"https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
"https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
"https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
"https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com",
"https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
"https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
"https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
"https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
"https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members",
"https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210",
"https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
"https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
"https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo",
"https://meumundogay-com.sexogratis.page/locker",
"https://es.pornhat.com/models/the-sex-creator/",
"Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
"Can the DoD no questions asked target a SA victim",
"Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
"There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
"socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
"There is fear in silence or speaking out",
"Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
"3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
"If someone is believed to be a threat they have right to due process.",
"Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
"She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
"Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
"Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
"ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
"iamrobert.com Y.A.S.",
"1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam",
"Target agreed and complied with all lie detector measures.",
"Is the family allowed to have a funeral for Tsara or print an obituary",
"No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
"I am very upset. Whoever is doing this is sick."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "APNIC",
"display_name": "APNIC",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
}
],
"attack_ids": [
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1573",
"name": "Encrypted Channel",
"display_name": "T1573 - Encrypted Channel"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1069.002",
"name": "Domain Groups",
"display_name": "T1069.002 - Domain Groups"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1583.001",
"name": "Domains",
"display_name": "T1583.001 - Domains"
},
{
"id": "TA0042",
"name": "Resource Development",
"display_name": "TA0042 - Resource Development"
},
{
"id": "TA0005",
"name": "Defense Evasion",
"display_name": "TA0005 - Defense Evasion"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1528",
"name": "Steal Application Access Token",
"display_name": "T1528 - Steal Application Access Token"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1132",
"name": "Data Encoding",
"display_name": "T1132 - Data Encoding"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1457",
"name": "Malicious Media Content",
"display_name": "T1457 - Malicious Media Content"
},
{
"id": "T1562.001",
"name": "Disable or Modify Tools",
"display_name": "T1562.001 - Disable or Modify Tools"
},
{
"id": "T1562.004",
"name": "Disable or Modify System Firewall",
"display_name": "T1562.004 - Disable or Modify System Firewall"
},
{
"id": "T1089",
"name": "Disabling Security Tools",
"display_name": "T1089 - Disabling Security Tools"
},
{
"id": "T1562.008",
"name": "Disable Cloud Logs",
"display_name": "T1562.008 - Disable Cloud Logs"
},
{
"id": "T1125",
"name": "Video Capture",
"display_name": "T1125 - Video Capture"
},
{
"id": "T1056.003",
"name": "Web Portal Capture",
"display_name": "T1056.003 - Web Portal Capture"
},
{
"id": "T1512",
"name": "Capture Camera",
"display_name": "T1512 - Capture Camera"
},
{
"id": "T1180",
"name": "Screensaver",
"display_name": "T1180 - Screensaver"
}
],
"industries": [],
"TLP": "white",
"cloned_from": "68e2b14d83bb63502feac65e",
"export_count": 17,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"domain": 1365,
"URL": 11172,
"hostname": 2780,
"FileHash-MD5": 381,
"FileHash-SHA256": 4420,
"FileHash-SHA1": 338,
"CIDR": 4,
"SSLCertFingerprint": 24,
"CVE": 1,
"email": 1
},
"indicator_count": 20486,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "139 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68e2b14d83bb63502feac65e",
"name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
"description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech needed. Later denies ever being a mobility technician. They killed a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
"modified": "2026-01-07T00:00:30.717000",
"created": "2025-10-05T17:56:29.109000",
"tags": [
"gtmk5nxqc6",
"utc amazon",
"utc na",
"acceptencoding",
"gmt contenttype",
"connection",
"true pragma",
"gmt setcookie",
"httponly",
"gmt vary",
"nc000000 up",
"html document",
"unicode text",
"utf8 text",
"oc0006 http",
"http traffic",
"https http",
"mitre att",
"control ta0011",
"protocol t1071",
"match info",
"t1573 severity",
"info",
"number",
"ja3s",
"algorithm",
"azure rsa",
"tls issuing",
"cus subject",
"stwa lredmond",
"cnmicrosoft ecc",
"update secure",
"server ca",
"omicrosoft cus",
"get http",
"dns resolutions",
"registrar",
"markmonitor inc",
"country",
"resolver domain",
"type name",
"html",
"apnic",
"apnic whois",
"please",
"rirs",
"cidr",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"command",
"adversaries",
"development att",
"name tactics",
"binary file",
"ck matrix",
"wheelchair",
"iamrobert",
"pattern match",
"ascii text",
"href",
"united",
"general",
"local",
"path",
"encrypt",
"click",
"passive dns",
"urls",
"files",
"reverse dns",
"netherlands",
"present aug",
"a domains",
"moved",
"first pqc",
"ip address",
"unknown ns",
"unknown aaaa",
"title",
"body",
"meta",
"window",
"accept",
"body doctype",
"welcome",
"ok server",
"gmt content",
"present jul",
"present sep",
"aaaa",
"hostname",
"error",
"defense evasion",
"windows nt",
"response",
"vary",
"strings",
"core",
"t1027.013 encrypted/encoded",
"michelin lazy k",
"prefetch8",
"flag",
"date",
"starfield",
"hybrid",
"mobility cr",
"extraction",
"data upload",
"include",
"o url",
"url url",
"included i0",
"review ioc",
"excluded ic",
"suggested",
"find sugi",
"failed",
"cre pul",
"enter",
"enter sc",
"type",
"enric",
"extra",
"type opaste",
"data u",
"included",
"copy md5",
"copy sha1",
"copy sha256",
"null",
"refresh",
"tools",
"look",
"verify",
"restart",
"t1480 execution",
"expiration",
"url https",
"no expiration",
"iocs",
"ipv4",
"text drag",
"drop or",
"browse to",
"select file",
"redacted for",
"server",
"privacy tech",
"privacy admin",
"postal code",
"stateprovince",
"organization",
"email",
"code",
"quantum rooms",
"sam somalia",
"emp",
"porn",
"media defense",
"gov porn",
"suck my nips",
"reimer suspect",
"jeffrey reimer",
"dod",
"department of defense",
"show",
"date checked",
"url hostname",
"server response",
"google safe",
"results may",
"entries http",
"scans record",
"value status",
"sabey type",
"merits fake",
"y.a.s.",
"pornography",
"ramsom"
],
"references": [
"https://www.meritshealth.com/ Defense.Gov Mobility Co? ",
"zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
"https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
"https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
"https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
"https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com",
"https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
"https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
"https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
"https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
"https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members",
"https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210",
"https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
"https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
"https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo",
"https://meumundogay-com.sexogratis.page/locker",
"https://es.pornhat.com/models/the-sex-creator/",
"Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
"Can the DoD no questions asked target a SA victim",
"Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
"There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
"socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
"There is fear in silence or speaking out",
"Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
"3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
"If someone is believed to be a threat they have right to due process.",
"Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
"She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
"Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
"Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
"ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
"iamrobert.com Y.A.S.",
"1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam",
"Target agreed and complied with all lie detector measures.",
"Is the family allowed to have a funeral for Tsara or print an obituary",
"No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
"I am very upset. Whoever is doing this is sick."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "APNIC",
"display_name": "APNIC",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
}
],
"attack_ids": [
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1573",
"name": "Encrypted Channel",
"display_name": "T1573 - Encrypted Channel"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1069.002",
"name": "Domain Groups",
"display_name": "T1069.002 - Domain Groups"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1583.001",
"name": "Domains",
"display_name": "T1583.001 - Domains"
},
{
"id": "TA0042",
"name": "Resource Development",
"display_name": "TA0042 - Resource Development"
},
{
"id": "TA0005",
"name": "Defense Evasion",
"display_name": "TA0005 - Defense Evasion"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1528",
"name": "Steal Application Access Token",
"display_name": "T1528 - Steal Application Access Token"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1132",
"name": "Data Encoding",
"display_name": "T1132 - Data Encoding"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1457",
"name": "Malicious Media Content",
"display_name": "T1457 - Malicious Media Content"
},
{
"id": "T1562.001",
"name": "Disable or Modify Tools",
"display_name": "T1562.001 - Disable or Modify Tools"
},
{
"id": "T1562.004",
"name": "Disable or Modify System Firewall",
"display_name": "T1562.004 - Disable or Modify System Firewall"
},
{
"id": "T1089",
"name": "Disabling Security Tools",
"display_name": "T1089 - Disabling Security Tools"
},
{
"id": "T1562.008",
"name": "Disable Cloud Logs",
"display_name": "T1562.008 - Disable Cloud Logs"
},
{
"id": "T1125",
"name": "Video Capture",
"display_name": "T1125 - Video Capture"
},
{
"id": "T1056.003",
"name": "Web Portal Capture",
"display_name": "T1056.003 - Web Portal Capture"
},
{
"id": "T1512",
"name": "Capture Camera",
"display_name": "T1512 - Capture Camera"
},
{
"id": "T1180",
"name": "Screensaver",
"display_name": "T1180 - Screensaver"
}
],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 11,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 1,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"domain": 1328,
"URL": 9931,
"hostname": 2621,
"FileHash-MD5": 381,
"FileHash-SHA256": 4360,
"FileHash-SHA1": 338,
"CIDR": 4,
"SSLCertFingerprint": 24,
"CVE": 1,
"email": 1
},
"indicator_count": 18989,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "145 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6923408464566e39caf32285",
"name": "Discord- DNS | Malvertizing | Ransom/Msilzilla (sifting IoC\u2019s created by scnrscnr)",
"description": "TAGS\nActive\n443 ma2592000\nChristopher Pool\nPool's Closed\nTimothy Pool\na li\n google\namerica att\napache\napache ip\nasn as46606\nauditmode force\nbehavior\nbinary\nbinary file\nbk role\nchat\ncheck\nchrome\nck ids\ncommon stealer\ncookie\ndata upload\ndefender\ndelete c\ndirectui\ndiscord\ndns lookup\ndomain add\ndrop\ndynamicloader\neb d8\nee fc\nerror oct\nexplorer\nexternal ip\nextraction\nf0 ff\nfailed\nff bb\nff d5\nff ff\nfiles\nfoundry\ngmt content\ngmt etag\ngmt server\ngoogle chrome\nguard\nhigh\ninsert\nlolminer\nmalware\nmedia\nmeta\nmoved\nmovie\nmsie\nmsvisualbasic60\nmtb aug -present \nneversend\npowershell\nrelated nids\nresponse ip\nself\nservice domain\nsingapore\nsmartassembly\nspan\nspan a\nsx08x00x00a\ntargeting\ntls sni\ntrojan\ntrojandropper\ntwitter\ntx08x00x00n\nunique\nuser agent\nux08x00x00h\nvirtool\nvirustotal api\nvoice\nvx08x00x00j\nwrite\nwrite c\nwx08x00x00\nx08x00x00b\nx08x00x00x00\nyara\nyara rule\nyx08x00x00l\nz3je\nz3uwq7\nzx08x00x00",
"modified": "2025-12-23T16:04:54.329000",
"created": "2025-11-23T17:12:36.917000",
"tags": [
"no expiration",
"expiration",
"url https",
"url http",
"filehashsha256",
"hostname",
"domain",
"filehashmd5",
"filehashsha1",
"ipv4",
"code",
"pool",
"timothy pool",
"z3je z3uwq7",
"creation date",
"ip address",
"emails",
"expiration date",
"status",
"hostname add",
"pulse pulses",
"passive dns",
"urls",
"date"
],
"references": [
"https://otx.alienvault.com/pulse/5fa57698ac0f6638b7b9a8ba",
"Examining pulse created by scnrscnr is worth reviewing. I was surprised tonal see a targets name.I didn\u2019t see Foundry highlighted",
"http://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com",
"https://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com \u2022 www.techcult.com/judge-the-simpsons-parody-is-child-pornography/ Whitelisted domain techcult.com\t Domain blogspot.com Whitelisted domain blogspot.com\t Domain techcult.com Whitelisted domain techcult.com\t Hostname aninditaannisa.blogspot.com \u2022 domain blogspot.com",
"www.techcult.com",
"http://foundry.tartarynova.com phishing \u2022 https://foundry.tartarynova.com \u2022 foundry.tartarynova.com",
"https://trail.truefoundry.com/api/t/c/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE/enc_U2FsdGVkX1_wWHRx9nPGCEspZpUcIwc1yphMTxaaQ2ZAbsxOqRR4ibXcaYtcmgJ1UgabTFCHVVBLx2oAnBAW2h8el_edjHN72Ug0yKQePjKnSJEOnQvtq8MUPo0vkU1N",
"https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_L9bYYgL2HGng9mDsC",
"https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE",
"truefoundry.com \u2022 assets.production.truefoundry.com \u2022 cpt.llm-gateway.truefoundry.com",
"yyz.llm-gateway.truefoundry.com \u2022 trail.truefoundry.com \u2022 sin.llm-gateway.truefoundry.com",
"lm-gateway.truefoundry.com \u2022 https://assets.production.truefoundry.com/sample-openapi.json",
"162.159.128.233 \u2022 http://tsar.vicly.org \u2022 https://tsar.vicly.org \u2022 tsar.vicly.org \u2022 vicly.org \u2022 https://tsar.vicly.org/",
"http://scteamcommunity.com/4k-high-res-porn-videos/squirt phishing",
"http://pic.porn.hub-accessories.site \u2022 https://pic.porn.hub-accessories.site \u2022 pic.porn.hub-accessories.site",
"2022ww11.pornhubgsy.com \u2022 http://scteamcommunity.com/4k-high-res-porn-videos/squirt",
"IDS Detections: Observed Discord Domain in DNS Lookup (discord .com) Discord Chat Service Domain in DNS Lookup (discord .com)",
"IDS Detections: Observed Discord Domain (discord .com in TLS SNI)",
"IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"IDS Detections: Observed Discord Domain (discordapp .com in TLS SNI) Observed Discord Service Domain (discord .com) in TLS SNI Less",
"Yara: Detections ConventionEngine_Term_Users",
"Yara: ConventionEngine_Anomaly_MultiPDB_Double , ConventionEngine_Term_Documents",
"Alerts: infostealer_browser infostealer_cookies binary_yara procmem_yara static_pe_anomaly",
"Alerts: pe_compile_timestomping antiav_detectfile antidebug_guardpages encrypted_ioc",
"Alerts: dynamic_function_loading injection_write_process reads_memory_remote_process",
"Alerts : network_cnc_https_generic reads_self packer_entropy injection_rwx uses_windows_utilities antivm_checks_available_memory queries_computer_name queries_user_name",
"Yara : MS_Visual_Basic_6_0 ,",
"Yara : UPX , Nrv2x , UPX_OEP_place , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser",
"Alerts : ransomware_file_modifications stealth_file procmem_yara static_pe_anomaly",
"Alerts: disables_folder_options stealth_hidden_extension stealth_hiddenreg anomalous_deletefile",
"Alerts: mouse_movement_detect",
"Couldn\u2019t pulse 1st pulse so here\u2019s what\u2019s left",
"scnrscnr pulse is good. I\u2019m assuming they\u2019re targets.",
"Foundry stalking."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "TrojanDropper:Win32/VB.IL0",
"display_name": "TrojanDropper:Win32/VB.IL0",
"target": "/malware/TrojanDropper:Win32/VB.IL0"
},
{
"id": "ALF:Trojan:Win32/Cassini_56a3061!ibt",
"display_name": "ALF:Trojan:Win32/Cassini_56a3061!ibt",
"target": null
},
{
"id": "Win.Ransomware.Msilzilla-10014498-0",
"display_name": "Win.Ransomware.Msilzilla-10014498-0",
"target": null
}
],
"attack_ids": [
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1119",
"name": "Automated Collection",
"display_name": "T1119 - Automated Collection"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "T1443",
"name": "Remotely Install Application",
"display_name": "T1443 - Remotely Install Application"
},
{
"id": "T1546",
"name": "Event Triggered Execution",
"display_name": "T1546 - Event Triggered Execution"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 7,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 773,
"FileHash-SHA1": 684,
"FileHash-SHA256": 1910,
"CVE": 2,
"SSLCertFingerprint": 4,
"URL": 3783,
"domain": 878,
"email": 7,
"hostname": 1913
},
"indicator_count": 9954,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "159 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68c62306c74c7f57dc993d13",
"name": "Predator - Dr. Jeffrey Reimer, DPT - Physical Therapist in Denver, CO | Healthgrades",
"description": "Malware with code overlap. JSR , DPT Health Grades account has been removed. An investigator claims Reimer & family have been moved, names , career , changes years ago, claims of government protection for him. After victims MRI JSR left town immediately. Returning in 2016 , coincidentally driving near victim location on various locations. \nIt\u2019s disgusting how technology is being used to cover up a crime instead of solve one.\n#code_overlap #malware #hosts_contacted\n#itstoolatetoapologizeitstoolate",
"modified": "2025-10-14T01:04:58.605000",
"created": "2025-09-14T02:05:58.793000",
"tags": [
"denver",
"jeffrey reimer",
"star rating",
"appointment",
"post",
"response are",
"listened",
"wait",
"reimer",
"healthgrades",
"reply flag",
"doctors",
"find",
"jeff",
"back",
"aurora",
"leave",
"crying",
"tips",
"tags na",
"utc scorecard",
"research beacon",
"utc yahoo",
"dot tags",
"united",
"mozilla",
"write c",
"nsisinetc",
"undetermined",
"medium",
"intel",
"ms windows",
"write",
"trojan",
"defender",
"delphi",
"win32",
"malware",
"win64",
"local",
"next",
"code overlap",
"dynamicloader",
"as15169",
"brazil as28604",
"brazil as396982",
"upatre",
"passive dns",
"title error",
"ipv4 add",
"pulse pulses",
"urls",
"files",
"reverse dns",
"location united",
"america flag",
"body",
"script script",
"powder sdk",
"a domains",
"title",
"script",
"certificate",
"hostname add",
"pulse submit",
"meta",
"learn",
"command",
"ck id",
"name tactics",
"suspicious",
"informative",
"spawns",
"evasion att",
"t1480 execution",
"signing defense",
"flag",
"whois privacy",
"service name",
"server",
"contacted hosts",
"ip address",
"process details",
"size",
"div id",
"beginstring",
"beginerror",
"null",
"error",
"strings",
"refresh",
"tools",
"onload",
"click",
"span",
"remote access"
],
"references": [
"#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler",
"YARA: Delphi This program must be run under Win32 compilers TrojanWin32Fakemalard Ujhhd",
"CodeOverlap | All malware listed exists",
"Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"All #tags auto populated.",
"URL http://virii.es/M/Mobile Malware Attacks and Defense.pdf",
"blog.manpowergroup.com.py (aww like dadvocates)",
"https://isexychat.com/chatrooms/teen-chat/with-others/\t (sounds about right)",
"r53lbr.run-delete-app-sa-east-1-1.run-delete-test-sa-east-1-9zt9rjv.forgeapps.ec2.aws.dev"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"display_name": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"target": null
},
{
"id": "Win.Malware.Tfuvtcog-7194372-0",
"display_name": "Win.Malware.Tfuvtcog-7194372-0",
"target": null
},
{
"id": "Trojan.Win32.Fakemalard",
"display_name": "Trojan.Win32.Fakemalard",
"target": null
},
{
"id": "Code Overlap",
"display_name": "Code Overlap",
"target": null
},
{
"id": "Trojan.Win32.Banload",
"display_name": "Trojan.Win32.Banload",
"target": null
},
{
"id": "Formbook",
"display_name": "Formbook",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [
"Medical",
"Media",
"Government."
],
"TLP": "white",
"cloned_from": null,
"export_count": 11,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"hostname": 609,
"URL": 1550,
"domain": 280,
"FileHash-SHA256": 1428,
"FileHash-MD5": 133,
"FileHash-SHA1": 115,
"SSLCertFingerprint": 4
},
"indicator_count": 4119,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "230 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68c62316b24b23e6d4c579ef",
"name": "Predator - Dr. Jeffrey Reimer, DPT - Physical Therapist in Denver, CO | Healthgrades",
"description": "Malware with code overlap. JSR , DPT Health Grades account has been removed. An investigator claims Reimer & family have been moved, names , career , changes years ago, claims of government protection for him. After victims MRI JSR left town immediately. Returning in 2016 , coincidentally driving near victim location on various locations. \nIt\u2019s disgusting how technology is being used to cover up a crime instead of solve one.\n#code_overlap #malware #hosts_contacted\n#itstoolatetoapologizeitstoolate",
"modified": "2025-10-14T01:04:58.605000",
"created": "2025-09-14T02:06:14.853000",
"tags": [
"denver",
"jeffrey reimer",
"star rating",
"appointment",
"post",
"response are",
"listened",
"wait",
"reimer",
"healthgrades",
"reply flag",
"doctors",
"find",
"jeff",
"back",
"aurora",
"leave",
"crying",
"tips",
"tags na",
"utc scorecard",
"research beacon",
"utc yahoo",
"dot tags",
"united",
"mozilla",
"write c",
"nsisinetc",
"undetermined",
"medium",
"intel",
"ms windows",
"write",
"trojan",
"defender",
"delphi",
"win32",
"malware",
"win64",
"local",
"next",
"code overlap",
"dynamicloader",
"as15169",
"brazil as28604",
"brazil as396982",
"upatre",
"passive dns",
"title error",
"ipv4 add",
"pulse pulses",
"urls",
"files",
"reverse dns",
"location united",
"america flag",
"body",
"script script",
"powder sdk",
"a domains",
"title",
"script",
"certificate",
"hostname add",
"pulse submit",
"meta",
"learn",
"command",
"ck id",
"name tactics",
"suspicious",
"informative",
"spawns",
"evasion att",
"t1480 execution",
"signing defense",
"flag",
"whois privacy",
"service name",
"server",
"contacted hosts",
"ip address",
"process details",
"size",
"div id",
"beginstring",
"beginerror",
"null",
"error",
"strings",
"refresh",
"tools",
"onload",
"click",
"span",
"remote access"
],
"references": [
"#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler",
"YARA: Delphi This program must be run under Win32 compilers TrojanWin32Fakemalard Ujhhd",
"CodeOverlap | All malware listed exists",
"Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
"All #tags auto populated.",
"URL http://virii.es/M/Mobile Malware Attacks and Defense.pdf",
"blog.manpowergroup.com.py (aww like dadvocates)",
"https://isexychat.com/chatrooms/teen-chat/with-others/\t (sounds about right)",
"r53lbr.run-delete-app-sa-east-1-1.run-delete-test-sa-east-1-9zt9rjv.forgeapps.ec2.aws.dev"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"display_name": "#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler.",
"target": null
},
{
"id": "Win.Malware.Tfuvtcog-7194372-0",
"display_name": "Win.Malware.Tfuvtcog-7194372-0",
"target": null
},
{
"id": "Trojan.Win32.Fakemalard",
"display_name": "Trojan.Win32.Fakemalard",
"target": null
},
{
"id": "Code Overlap",
"display_name": "Code Overlap",
"target": null
},
{
"id": "Trojan.Win32.Banload",
"display_name": "Trojan.Win32.Banload",
"target": null
},
{
"id": "Formbook",
"display_name": "Formbook",
"target": null
},
{
"id": "Malware",
"display_name": "Malware",
"target": null
},
{
"id": "Too much to search for",
"display_name": "Too much to search for",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [
"Medical",
"Media",
"Government."
],
"TLP": "white",
"cloned_from": null,
"export_count": 9,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"hostname": 609,
"URL": 1550,
"domain": 280,
"FileHash-SHA256": 1428,
"FileHash-MD5": 133,
"FileHash-SHA1": 115,
"SSLCertFingerprint": 4
},
"indicator_count": 4119,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "230 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68ac1823eed9568e26950b98",
"name": "ELF: Mirai - Malicious media | sentient.industries | Palantir",
"description": "Malicious entity weaponizing AI and next level cyber attacks, targeting, hacking, espionage, tracking, bad traffic, botnet, honeypots, bots , ddos. \n\nIt\u2019s really easy to become a target. Protest a cause, become a victim of crime by someone protected by a major entity , incur a large loss insurance case or have a high profile potential lawsuit on and on\u2026 \n\nExcessive overreach, low accountability, no barrier to access, designed to be the cyber warfare weapon.\nIf this is a spoof and NOT Palantir which (but it is) still relentlessly , as malicious. You don\u2019t own your devices or privacy.\n\n#mustbestrangelyexitingtowatchthestoicsquirm",
"modified": "2025-09-24T07:05:04.439000",
"created": "2025-08-25T08:00:35.492000",
"tags": [
"sentientindustries",
"adult",
"pornography",
"targeting",
"content reputation",
"palantirfoundry",
"palantir",
"malicious media",
"tool",
"abuse",
"citizens",
"gay",
"united",
"cache control",
"access control",
"passive dns",
"ip address",
"body found",
"gmt content",
"express cache",
"accept",
"pragma",
"avast avg",
"mirai",
"games",
"aniporn",
"eporner",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"adversaries",
"command",
"javascript",
"defense evasion",
"spawns",
"attrib",
"extid",
"fbid",
"creatortool",
"pattern match",
"date",
"path",
"august",
"hybrid",
"general",
"click",
"strings",
"bham",
"this",
"core",
"unknown aaaa",
"moved",
"unknown ns",
"body",
"h1 center",
"title",
"data upload",
"extraction",
"iocs",
"monitored target",
"copy md5",
"copy sha1",
"copy sha256",
"mitre att",
"show technique",
"ck matrix",
"span",
"possible",
"local",
"meta",
"roboto",
"supportscookie",
"spearphishing",
"initial access",
"ssl certificate",
"t1105",
"T1027.013 - Encrypted/Encoded File"
],
"references": [
"https://targeting-ai.com/dr-wisit-cheungpasitporn-invite-dhonneur-a-paris-pour-intelligence-artificielle-et-nephrologie-2025/ (phishing)",
"conf.targeting-ai.com \u2022 http://conf.targeting-ai.com \u2022 https://conf.targeting-ai.com \u2022 https://droidcall.cc/EQBhOSFz/",
"http://securityidiots.com/Web-Pentest/SQL-Injection/bypass-login-using-sql-injection.html",
"1-ai-chatbox-widget-2iv.pages.dev",
"FileleHash Sha256 [7a6da9fd351d428e9bfb8edbbca1275d9cdaf7f0371c77d2c227645509f7ebec ELF:Mirai-GH\\ [Trj] \u2022 Unix.Trojan.Gafgyt-6748839",
"Found in Palantirfoundry in sentient.indusutries linked to songculture.com (downed)",
"Redirecting to /verify/547062ef [URL https://eporner.blog \u2022 IPv4 104.21.3.107]",
"https://hayageek.com/drag-and-drop-file-upload-jquery",
"https://hayageek.com/rsa-encryption-decryption-openssl-c/",
"https://www-321chat-com.webpkgcache.com/doc/-/s/www.321chat.com/",
"https://www.melitta.be/portal/pics/layout/touchicons/apple-touch-icon-precomposed.png [Key-Systems GmbH]",
"https://hybrid-analysis.com/sample/627cf8e9a89c998bd5cb607854bbe31b82679c116b4e3834ff942220d61d3488/68ac1098bfa5002fad02e045",
"T1027.013 - Encrypted/Encoded File"
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "PornBlackmailer",
"display_name": "PornBlackmailer",
"target": null
},
{
"id": "Win32/PornTool",
"display_name": "Win32/PornTool",
"target": null
},
{
"id": "Mirai",
"display_name": "Mirai",
"target": null
},
{
"id": "ELF:Mirai-GH\\ [Trj]",
"display_name": "ELF:Mirai-GH\\ [Trj]",
"target": null
},
{
"id": "Unix.Trojan.Gafgyt-6748839",
"display_name": "Unix.Trojan.Gafgyt-6748839",
"target": null
},
{
"id": "supportsCookie",
"display_name": "supportsCookie",
"target": null
}
],
"attack_ids": [
{
"id": "T1457",
"name": "Malicious Media Content",
"display_name": "T1457 - Malicious Media Content"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1059",
"name": "Command and Scripting Interpreter",
"display_name": "T1059 - Command and Scripting Interpreter"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1083",
"name": "File and Directory Discovery",
"display_name": "T1083 - File and Directory Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
},
{
"id": "T1555",
"name": "Credentials from Password Stores",
"display_name": "T1555 - Credentials from Password Stores"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
},
{
"id": "T1608.005",
"name": "Link Target",
"display_name": "T1608.005 - Link Target"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1204",
"name": "User Execution",
"display_name": "T1204 - User Execution"
},
{
"id": "T1583.001",
"name": "Domains",
"display_name": "T1583.001 - Domains"
},
{
"id": "T1566.002",
"name": "Spearphishing Link",
"display_name": "T1566.002 - Spearphishing Link"
},
{
"id": "T1566.001",
"name": "Spearphishing Attachment",
"display_name": "T1566.001 - Spearphishing Attachment"
},
{
"id": "T1553.002",
"name": "Code Signing",
"display_name": "T1553.002 - Code Signing"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1568.002",
"name": "Domain Generation Algorithms",
"display_name": "T1568.002 - Domain Generation Algorithms"
},
{
"id": "T1532",
"name": "Data Encrypted",
"display_name": "T1532 - Data Encrypted"
}
],
"industries": [
"Telecommunications",
"Technology",
"Civilian Society",
"Government"
],
"TLP": "white",
"cloned_from": null,
"export_count": 16,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 966,
"domain": 222,
"hostname": 272,
"FileHash-MD5": 78,
"FileHash-SHA1": 84,
"FileHash-SHA256": 346,
"SSLCertFingerprint": 10
},
"indicator_count": 1978,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 143,
"modified_text": "249 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
}
],
"error": null,
"vt": {
"error": "VirusTotal rate limit reached. Try again shortly.",
"indicator": "https://status.jianqun.me",
"type": "URL"
},
"abuseipdb": null,
"urlhaus": {
"indicator": "https://status.jianqun.me",
"type": "URL",
"found": false,
"verdict": "clean",
"error": null
},
"from_cache": true,
"_cached_at": 1780282237.809515
}