{
  "type": "URL",
  "indicator": "https://test.jmtstudios.org",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://test.jmtstudios.org",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3773144588,
      "indicator": "https://test.jmtstudios.org",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "68ee5e9f8cfc5fbc73142660",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:30:55.471000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5ea4d51d4a1cabdb4ee9",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:31:00.172000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d5d33d16ab7837e23bc01",
          "name": "howmanyofme.com  - Packed | Palantir",
          "description": "howmanyofme.com was a honeypot. The names listed are potentially monitored targets. One was verified target.||\nhttp://howmanyofme.com/search/?given=Tsara&sur=Brashears/\nhttp://ww2.howmanyofme.com/people/Carrie_Henn/\nhttp://ww2.howmanyofme.com/people/Rockmond_Dunbar/\nhttp://howmanyofme.com/people/John_Hurt/\nhttp://howmanyofme.com/people/Mary_Gross/\nhttp://howmanyofme.com/people/Kenneth_Tobey/\nhttp://ww2.howmanyofme.com/people/Royce_Clayton/\n\n\n#Palantir # #honeypot #howmanyofme",
          "modified": "2025-09-18T23:05:18.490000",
          "created": "2025-07-20T21:18:43.974000",
          "tags": [
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "search",
            "privacy service",
            "fbo registrant",
            "date",
            "entries",
            "how many",
            "destination",
            "port",
            "windows nt",
            "msie",
            "unknown",
            "et trojan",
            "poodle attack",
            "policy sslv3",
            "united kingdom",
            "suspicious",
            "copy",
            "virustotal",
            "malware",
            "write",
            "hostile",
            "next",
            "triton",
            "super node",
            "get reloaded",
            "x11 snf",
            "png image",
            "rgba",
            "post reloaded",
            "ascii text",
            "crlf line",
            "gnu message",
            "ms windows",
            "intel",
            "pe32",
            "host",
            "get babylon",
            "show",
            "babylon"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7185,
            "domain": 706,
            "hostname": 1906,
            "email": 5,
            "FileHash-SHA256": 3645,
            "FileHash-MD5": 330,
            "FileHash-SHA1": 135,
            "CVE": 1
          },
          "indicator_count": 13913,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "212 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65551682899b039e02b8dc8a",
          "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
          "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
          "modified": "2023-12-15T18:02:25.356000",
          "created": "2023-11-15T19:05:38.437000",
          "tags": [
            "strong",
            "saal digital",
            "photo portal",
            "daten",
            "support",
            "saal",
            "bersicht",
            "informationen",
            "profis",
            "rabatte fr",
            "service",
            "heur",
            "malware",
            "cisco umbrella",
            "adware",
            "safe site",
            "malware site",
            "malicious site",
            "phishing site",
            "alexa top",
            "million",
            "tiggre",
            "presenoker",
            "agent",
            "opencandy",
            "conduit",
            "unsafe",
            "wacatac",
            "artemis",
            "phishing",
            "iframe",
            "installpack",
            "xrat",
            "fusioncore",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "genkryptik",
            "exploit",
            "filetour",
            "cleaner",
            "webtoolbar",
            "trojanspy",
            "get fdm",
            "ms windows",
            "pe32",
            "intel",
            "search",
            "show",
            "united",
            "entries",
            "systemdrive",
            "program files",
            "installer",
            "write",
            "delphi",
            "next",
            "june",
            "win32",
            "copy",
            "pixel",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "variables",
            "langpage string",
            "lang",
            "saalgroup",
            "creoletohtml",
            "chat",
            "reverse dns",
            "resource",
            "general full",
            "asn16509",
            "amazon02",
            "url https",
            "security tls",
            "protocol h2",
            "hash",
            "get h2",
            "main",
            "request chain",
            "http",
            "de redirected",
            "http redirect",
            "site",
            "malicious url",
            "blacklist https",
            "domain",
            "screenshot",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "amazons3",
            "aes128gcm",
            "amazon rsa",
            "aes256",
            "date",
            "name verdict",
            "pattern match",
            "root ca",
            "script",
            "done adding",
            "catalog file",
            "file",
            "indicator",
            "authority",
            "class",
            "mitre att",
            "meta",
            "unknown",
            "error",
            "hybrid",
            "accept",
            "general",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "refresh",
            "tools",
            "null",
            "body",
            "create c",
            "html document",
            "xport",
            "noname057",
            "generic malware",
            "generic",
            "dapato",
            "alexa",
            "installcore",
            "downloader",
            "dropper",
            "outbreak",
            "iobit",
            "mediaget",
            "azorult",
            "runescape",
            "facebook",
            "bank",
            "download",
            "live",
            "rms",
            "maltiverse",
            "cyber threat",
            "engineering",
            "services",
            "malicious host",
            "malicious",
            "team",
            "zeus",
            "nymaim",
            "zbot",
            "simda",
            "asyncrat",
            "cobalt strike",
            "ransomware",
            "matsnu",
            "cutwail",
            "citadel",
            "pykspa",
            "raccoon",
            "kronos",
            "ramnit",
            "redline stealer",
            "apple",
            "apple",
            "html info",
            "title saal",
            "meta tags",
            "trackers google",
            "tag manager",
            "gtm5wjlq2",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "self",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "hostname",
            "anonymizer",
            "firehol",
            "mail spammer",
            "team proxy",
            "kraken",
            "suppobox",
            "tofsee",
            "vawtrak",
            "hotmail",
            "netsky",
            "stealer",
            "blacknet rat",
            "remcos",
            "miner",
            "hacktool",
            "trojan",
            "detplock",
            "team phishing",
            "a nxdomain",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "urls",
            "files",
            "ip address",
            "all search",
            "otx octoseek",
            "files ip",
            "contacted",
            "whois record",
            "ssl certificate",
            "pe resource",
            "bundled",
            "attack",
            "parent",
            "historical ssl",
            "collections",
            "communicating",
            "emotet",
            "execution",
            "markmonitor inc",
            "vhash",
            "authentihash",
            "imphash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "archive",
            "valid",
            "serial number",
            "valid from",
            "valid usage",
            "code signing",
            "status status",
            "valid issuer",
            "assured id",
            "issuer issuer",
            "symantec sha256",
            "sections",
            "file type",
            "trid generic",
            "cil executable",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "sections name",
            "streams size",
            "entropy chi2",
            "guid",
            "blob",
            "namecheap",
            "ip detections",
            "country",
            "resolutions",
            "referrer",
            "whois whois",
            "threat roundup",
            "parent domain",
            "CVE-2023-22518",
            "CVE-2017-0143",
            "CVE-2017-0147",
            "CVE-2020-0601",
            "CVE-2017-8570",
            "CVE-2018-4893",
            "CVE-2017-11882",
            "CVE-2017-0199",
            "CVE-2014-3153",
            "W32.AIDetectNet.01",
            "trojan.adload/ursu",
            "targeting tsara brashears",
            "cybercrime",
            "privilege escalation",
            "defacement",
            "privilege abuse",
            "soc",
            "red team",
            "social engineering",
            "retaliation",
            "assault victim",
            "obsession"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
            "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
            "\u2193 Interesting \u2193",
            "owa.telegrafix.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
            "christ.robert@gmx.de",
            "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
            "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
            "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
            "BEELab_web_1.0.2-prerelease.exe",
            "AfraidZad.exe",
            "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
            "greycroftpartners.com",
            "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
            "trkpls3.com",
            "eg-monitoring.com",
            "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
            "https://twitter.com/PORNO_SEXYBABES"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Italy",
            "Singapore",
            "France",
            "Germany",
            "Korea, Republic of"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "RMS",
              "display_name": "RMS",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 841,
            "FileHash-SHA1": 467,
            "FileHash-SHA256": 6370,
            "CVE": 9,
            "domain": 2160,
            "hostname": 3074,
            "email": 1,
            "URL": 6550,
            "SSLCertFingerprint": 1,
            "CIDR": 3
          },
          "indicator_count": 19476,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655516871038cbad9eae2bb7",
          "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
          "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
          "modified": "2023-12-15T18:02:25.356000",
          "created": "2023-11-15T19:05:43.285000",
          "tags": [
            "strong",
            "saal digital",
            "photo portal",
            "daten",
            "support",
            "saal",
            "bersicht",
            "informationen",
            "profis",
            "rabatte fr",
            "service",
            "heur",
            "malware",
            "cisco umbrella",
            "adware",
            "safe site",
            "malware site",
            "malicious site",
            "phishing site",
            "alexa top",
            "million",
            "tiggre",
            "presenoker",
            "agent",
            "opencandy",
            "conduit",
            "unsafe",
            "wacatac",
            "artemis",
            "phishing",
            "iframe",
            "installpack",
            "xrat",
            "fusioncore",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "genkryptik",
            "exploit",
            "filetour",
            "cleaner",
            "webtoolbar",
            "trojanspy",
            "get fdm",
            "ms windows",
            "pe32",
            "intel",
            "search",
            "show",
            "united",
            "entries",
            "systemdrive",
            "program files",
            "installer",
            "write",
            "delphi",
            "next",
            "june",
            "win32",
            "copy",
            "pixel",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "variables",
            "langpage string",
            "lang",
            "saalgroup",
            "creoletohtml",
            "chat",
            "reverse dns",
            "resource",
            "general full",
            "asn16509",
            "amazon02",
            "url https",
            "security tls",
            "protocol h2",
            "hash",
            "get h2",
            "main",
            "request chain",
            "http",
            "de redirected",
            "http redirect",
            "site",
            "malicious url",
            "blacklist https",
            "domain",
            "screenshot",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "amazons3",
            "aes128gcm",
            "amazon rsa",
            "aes256",
            "date",
            "name verdict",
            "pattern match",
            "root ca",
            "script",
            "done adding",
            "catalog file",
            "file",
            "indicator",
            "authority",
            "class",
            "mitre att",
            "meta",
            "unknown",
            "error",
            "hybrid",
            "accept",
            "general",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "refresh",
            "tools",
            "null",
            "body",
            "create c",
            "html document",
            "xport",
            "noname057",
            "generic malware",
            "generic",
            "dapato",
            "alexa",
            "installcore",
            "downloader",
            "dropper",
            "outbreak",
            "iobit",
            "mediaget",
            "azorult",
            "runescape",
            "facebook",
            "bank",
            "download",
            "live",
            "rms",
            "maltiverse",
            "cyber threat",
            "engineering",
            "services",
            "malicious host",
            "malicious",
            "team",
            "zeus",
            "nymaim",
            "zbot",
            "simda",
            "asyncrat",
            "cobalt strike",
            "ransomware",
            "matsnu",
            "cutwail",
            "citadel",
            "pykspa",
            "raccoon",
            "kronos",
            "ramnit",
            "redline stealer",
            "apple",
            "apple",
            "html info",
            "title saal",
            "meta tags",
            "trackers google",
            "tag manager",
            "gtm5wjlq2",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "self",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "hostname",
            "anonymizer",
            "firehol",
            "mail spammer",
            "team proxy",
            "kraken",
            "suppobox",
            "tofsee",
            "vawtrak",
            "hotmail",
            "netsky",
            "stealer",
            "blacknet rat",
            "remcos",
            "miner",
            "hacktool",
            "trojan",
            "detplock",
            "team phishing",
            "a nxdomain",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "urls",
            "files",
            "ip address",
            "all search",
            "otx octoseek",
            "files ip",
            "contacted",
            "whois record",
            "ssl certificate",
            "pe resource",
            "bundled",
            "attack",
            "parent",
            "historical ssl",
            "collections",
            "communicating",
            "emotet",
            "execution",
            "markmonitor inc",
            "vhash",
            "authentihash",
            "imphash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "archive",
            "valid",
            "serial number",
            "valid from",
            "valid usage",
            "code signing",
            "status status",
            "valid issuer",
            "assured id",
            "issuer issuer",
            "symantec sha256",
            "sections",
            "file type",
            "trid generic",
            "cil executable",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "sections name",
            "streams size",
            "entropy chi2",
            "guid",
            "blob",
            "namecheap",
            "ip detections",
            "country",
            "resolutions",
            "referrer",
            "whois whois",
            "threat roundup",
            "parent domain",
            "CVE-2023-22518",
            "CVE-2017-0143",
            "CVE-2017-0147",
            "CVE-2020-0601",
            "CVE-2017-8570",
            "CVE-2018-4893",
            "CVE-2017-11882",
            "CVE-2017-0199",
            "CVE-2014-3153",
            "W32.AIDetectNet.01",
            "trojan.adload/ursu",
            "targeting tsara brashears",
            "cybercrime",
            "privilege escalation",
            "defacement",
            "privilege abuse",
            "soc",
            "red team",
            "social engineering",
            "retaliation",
            "assault victim",
            "obsession"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
            "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
            "\u2193 Interesting \u2193",
            "owa.telegrafix.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
            "christ.robert@gmx.de",
            "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
            "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
            "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
            "BEELab_web_1.0.2-prerelease.exe",
            "AfraidZad.exe",
            "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
            "greycroftpartners.com",
            "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
            "trkpls3.com",
            "eg-monitoring.com",
            "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
            "https://twitter.com/PORNO_SEXYBABES"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Italy",
            "Singapore",
            "France",
            "Germany",
            "Korea, Republic of"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "RMS",
              "display_name": "RMS",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 841,
            "FileHash-SHA1": 467,
            "FileHash-SHA256": 6370,
            "CVE": 9,
            "domain": 2160,
            "hostname": 3074,
            "email": 1,
            "URL": 6550,
            "SSLCertFingerprint": 1,
            "CIDR": 3
          },
          "indicator_count": 19476,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a9b81da64500aa609122",
          "name": "APPLE CVE",
          "description": "",
          "modified": "2023-12-06T17:04:56.966000",
          "created": "2023-12-06T17:04:56.966000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 705,
            "FileHash-MD5": 171,
            "domain": 242,
            "hostname": 361,
            "URL": 496,
            "email": 3,
            "FileHash-SHA1": 123,
            "CVE": 1,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 2106,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 114,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6556878669ae5d5aa6b1a61f",
          "name": "APPLE CVE",
          "description": "",
          "modified": "2023-11-16T21:20:06.454000",
          "created": "2023-11-16T21:20:06.454000",
          "tags": [
            "scan endpoints",
            "all cve",
            "ellenmmm cve",
            "pulse pulses",
            "files",
            "exploits",
            "targeted",
            "cve overview",
            "ventura",
            "creation date",
            "impact"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "652e0a354e1ed460e652842c",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 523,
            "domain": 263,
            "hostname": 460,
            "FileHash-SHA256": 1269,
            "FileHash-MD5": 385,
            "FileHash-SHA1": 329,
            "SSLCertFingerprint": 4,
            "email": 3
          },
          "indicator_count": 3237,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "884 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652e0a354e1ed460e652842c",
          "name": "APPLE CVE",
          "description": "Apple has fixed a bug in its operating system that may cause files to be infected with malware and then be opened and downloaded without a quarantine flag being put on the file, as well as a security check.",
          "modified": "2023-11-16T16:02:38.424000",
          "created": "2023-10-17T04:14:45.289000",
          "tags": [
            "scan endpoints",
            "all cve",
            "ellenmmm cve",
            "pulse pulses",
            "files",
            "exploits",
            "targeted",
            "cve overview",
            "ventura",
            "creation date",
            "impact"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ellenmmm",
            "id": "233693",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 523,
            "domain": 263,
            "hostname": 460,
            "FileHash-SHA256": 1269,
            "FileHash-MD5": 385,
            "FileHash-SHA1": 329,
            "SSLCertFingerprint": 4,
            "email": 3
          },
          "indicator_count": 3237,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 86,
          "modified_text": "885 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
        "BEELab_web_1.0.2-prerelease.exe",
        "eg-monitoring.com",
        "http://api.jmtstudios.org/",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
        "trkpls3.com",
        "https://twitter.com/PORNO_SEXYBABES",
        "bricked.wtf",
        "christ.robert@gmx.de",
        "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
        "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "greycroftpartners.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "\u2193 Interesting \u2193",
        "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
        "owa.telegrafix.com",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "AfraidZad.exe",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Upadter",
            "Webtoolbar",
            "Maltiverse",
            "Generic",
            "Win.malware.convagent-9981433-0",
            "Rms",
            "Trojanspy",
            "Mydoom"
          ],
          "industries": [],
          "unique_indicators": 56950
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/jmtstudios.org",
    "whois": "http://whois.domaintools.com/jmtstudios.org",
    "domain": "jmtstudios.org",
    "hostname": "test.jmtstudios.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "68ee5e9f8cfc5fbc73142660",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:30:55.471000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5ea4d51d4a1cabdb4ee9",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:31:00.172000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d5d33d16ab7837e23bc01",
      "name": "howmanyofme.com  - Packed | Palantir",
      "description": "howmanyofme.com was a honeypot. The names listed are potentially monitored targets. One was verified target.||\nhttp://howmanyofme.com/search/?given=Tsara&sur=Brashears/\nhttp://ww2.howmanyofme.com/people/Carrie_Henn/\nhttp://ww2.howmanyofme.com/people/Rockmond_Dunbar/\nhttp://howmanyofme.com/people/John_Hurt/\nhttp://howmanyofme.com/people/Mary_Gross/\nhttp://howmanyofme.com/people/Kenneth_Tobey/\nhttp://ww2.howmanyofme.com/people/Royce_Clayton/\n\n\n#Palantir # #honeypot #howmanyofme",
      "modified": "2025-09-18T23:05:18.490000",
      "created": "2025-07-20T21:18:43.974000",
      "tags": [
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "search",
        "privacy service",
        "fbo registrant",
        "date",
        "entries",
        "how many",
        "destination",
        "port",
        "windows nt",
        "msie",
        "unknown",
        "et trojan",
        "poodle attack",
        "policy sslv3",
        "united kingdom",
        "suspicious",
        "copy",
        "virustotal",
        "malware",
        "write",
        "hostile",
        "next",
        "triton",
        "super node",
        "get reloaded",
        "x11 snf",
        "png image",
        "rgba",
        "post reloaded",
        "ascii text",
        "crlf line",
        "gnu message",
        "ms windows",
        "intel",
        "pe32",
        "host",
        "get babylon",
        "show",
        "babylon"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 7185,
        "domain": 706,
        "hostname": 1906,
        "email": 5,
        "FileHash-SHA256": 3645,
        "FileHash-MD5": 330,
        "FileHash-SHA1": 135,
        "CVE": 1
      },
      "indicator_count": 13913,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "212 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68858e8244c8db854e8947c1",
      "name": "Goodreads Malware",
      "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
      "modified": "2025-08-26T01:03:19.405000",
      "created": "2025-07-27T02:27:14.517000",
      "tags": [
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "united",
        "flag united",
        "present jun",
        "present may",
        "present apr",
        "search",
        "moved",
        "creation date",
        "record value",
        "date",
        "body",
        "meta",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "memcommit",
        "value1",
        "partnerid4146",
        "username",
        "gamesessionid",
        "port",
        "destination",
        "regsetvalueexa",
        "mozilla",
        "write",
        "persistence",
        "execution",
        "malware",
        "copy",
        "next",
        "process32nextw",
        "show",
        "entries",
        "module load",
        "t1129",
        "intel",
        "ms windows",
        "showing",
        "t1045",
        "win32",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "pattern match",
        "ascii text",
        "null",
        "error",
        "starfield",
        "click",
        "hybrid",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "smbds ipc",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "yara detections",
        "nrv2x",
        "upxoepplace"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 155,
        "hostname": 1237,
        "FileHash-SHA256": 1141,
        "domain": 574,
        "URL": 4593,
        "FileHash-SHA1": 139,
        "email": 1,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 7848,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "236 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65551682899b039e02b8dc8a",
      "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
      "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
      "modified": "2023-12-15T18:02:25.356000",
      "created": "2023-11-15T19:05:38.437000",
      "tags": [
        "strong",
        "saal digital",
        "photo portal",
        "daten",
        "support",
        "saal",
        "bersicht",
        "informationen",
        "profis",
        "rabatte fr",
        "service",
        "heur",
        "malware",
        "cisco umbrella",
        "adware",
        "safe site",
        "malware site",
        "malicious site",
        "phishing site",
        "alexa top",
        "million",
        "tiggre",
        "presenoker",
        "agent",
        "opencandy",
        "conduit",
        "unsafe",
        "wacatac",
        "artemis",
        "phishing",
        "iframe",
        "installpack",
        "xrat",
        "fusioncore",
        "riskware",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "genkryptik",
        "exploit",
        "filetour",
        "cleaner",
        "webtoolbar",
        "trojanspy",
        "get fdm",
        "ms windows",
        "pe32",
        "intel",
        "search",
        "show",
        "united",
        "entries",
        "systemdrive",
        "program files",
        "installer",
        "write",
        "delphi",
        "next",
        "june",
        "win32",
        "copy",
        "pixel",
        "search live",
        "api blog",
        "docs pricing",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "follow",
        "value",
        "variables",
        "langpage string",
        "lang",
        "saalgroup",
        "creoletohtml",
        "chat",
        "reverse dns",
        "resource",
        "general full",
        "asn16509",
        "amazon02",
        "url https",
        "security tls",
        "protocol h2",
        "hash",
        "get h2",
        "main",
        "request chain",
        "http",
        "de redirected",
        "http redirect",
        "site",
        "malicious url",
        "blacklist https",
        "domain",
        "screenshot",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "amazons3",
        "aes128gcm",
        "amazon rsa",
        "aes256",
        "date",
        "name verdict",
        "pattern match",
        "root ca",
        "script",
        "done adding",
        "catalog file",
        "file",
        "indicator",
        "authority",
        "class",
        "mitre att",
        "meta",
        "unknown",
        "error",
        "hybrid",
        "accept",
        "general",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "refresh",
        "tools",
        "null",
        "body",
        "create c",
        "html document",
        "xport",
        "noname057",
        "generic malware",
        "generic",
        "dapato",
        "alexa",
        "installcore",
        "downloader",
        "dropper",
        "outbreak",
        "iobit",
        "mediaget",
        "azorult",
        "runescape",
        "facebook",
        "bank",
        "download",
        "live",
        "rms",
        "maltiverse",
        "cyber threat",
        "engineering",
        "services",
        "malicious host",
        "malicious",
        "team",
        "zeus",
        "nymaim",
        "zbot",
        "simda",
        "asyncrat",
        "cobalt strike",
        "ransomware",
        "matsnu",
        "cutwail",
        "citadel",
        "pykspa",
        "raccoon",
        "kronos",
        "ramnit",
        "redline stealer",
        "apple",
        "apple",
        "html info",
        "title saal",
        "meta tags",
        "trackers google",
        "tag manager",
        "gtm5wjlq2",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "self",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "hostname",
        "anonymizer",
        "firehol",
        "mail spammer",
        "team proxy",
        "kraken",
        "suppobox",
        "tofsee",
        "vawtrak",
        "hotmail",
        "netsky",
        "stealer",
        "blacknet rat",
        "remcos",
        "miner",
        "hacktool",
        "trojan",
        "detplock",
        "team phishing",
        "a nxdomain",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "urls",
        "files",
        "ip address",
        "all search",
        "otx octoseek",
        "files ip",
        "contacted",
        "whois record",
        "ssl certificate",
        "pe resource",
        "bundled",
        "attack",
        "parent",
        "historical ssl",
        "collections",
        "communicating",
        "emotet",
        "execution",
        "markmonitor inc",
        "vhash",
        "authentihash",
        "imphash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "archive",
        "valid",
        "serial number",
        "valid from",
        "valid usage",
        "code signing",
        "status status",
        "valid issuer",
        "assured id",
        "issuer issuer",
        "symantec sha256",
        "sections",
        "file type",
        "trid generic",
        "cil executable",
        "contained",
        "details module",
        "version id",
        "typelib id",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "sections name",
        "streams size",
        "entropy chi2",
        "guid",
        "blob",
        "namecheap",
        "ip detections",
        "country",
        "resolutions",
        "referrer",
        "whois whois",
        "threat roundup",
        "parent domain",
        "CVE-2023-22518",
        "CVE-2017-0143",
        "CVE-2017-0147",
        "CVE-2020-0601",
        "CVE-2017-8570",
        "CVE-2018-4893",
        "CVE-2017-11882",
        "CVE-2017-0199",
        "CVE-2014-3153",
        "W32.AIDetectNet.01",
        "trojan.adload/ursu",
        "targeting tsara brashears",
        "cybercrime",
        "privilege escalation",
        "defacement",
        "privilege abuse",
        "soc",
        "red team",
        "social engineering",
        "retaliation",
        "assault victim",
        "obsession"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
        "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
        "\u2193 Interesting \u2193",
        "owa.telegrafix.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
        "christ.robert@gmx.de",
        "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
        "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
        "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
        "BEELab_web_1.0.2-prerelease.exe",
        "AfraidZad.exe",
        "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
        "greycroftpartners.com",
        "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
        "trkpls3.com",
        "eg-monitoring.com",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "https://twitter.com/PORNO_SEXYBABES"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Italy",
        "Singapore",
        "France",
        "Germany",
        "Korea, Republic of"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "RMS",
          "display_name": "RMS",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 841,
        "FileHash-SHA1": 467,
        "FileHash-SHA256": 6370,
        "CVE": 9,
        "domain": 2160,
        "hostname": 3074,
        "email": 1,
        "URL": 6550,
        "SSLCertFingerprint": 1,
        "CIDR": 3
      },
      "indicator_count": 19476,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655516871038cbad9eae2bb7",
      "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
      "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
      "modified": "2023-12-15T18:02:25.356000",
      "created": "2023-11-15T19:05:43.285000",
      "tags": [
        "strong",
        "saal digital",
        "photo portal",
        "daten",
        "support",
        "saal",
        "bersicht",
        "informationen",
        "profis",
        "rabatte fr",
        "service",
        "heur",
        "malware",
        "cisco umbrella",
        "adware",
        "safe site",
        "malware site",
        "malicious site",
        "phishing site",
        "alexa top",
        "million",
        "tiggre",
        "presenoker",
        "agent",
        "opencandy",
        "conduit",
        "unsafe",
        "wacatac",
        "artemis",
        "phishing",
        "iframe",
        "installpack",
        "xrat",
        "fusioncore",
        "riskware",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "genkryptik",
        "exploit",
        "filetour",
        "cleaner",
        "webtoolbar",
        "trojanspy",
        "get fdm",
        "ms windows",
        "pe32",
        "intel",
        "search",
        "show",
        "united",
        "entries",
        "systemdrive",
        "program files",
        "installer",
        "write",
        "delphi",
        "next",
        "june",
        "win32",
        "copy",
        "pixel",
        "search live",
        "api blog",
        "docs pricing",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "follow",
        "value",
        "variables",
        "langpage string",
        "lang",
        "saalgroup",
        "creoletohtml",
        "chat",
        "reverse dns",
        "resource",
        "general full",
        "asn16509",
        "amazon02",
        "url https",
        "security tls",
        "protocol h2",
        "hash",
        "get h2",
        "main",
        "request chain",
        "http",
        "de redirected",
        "http redirect",
        "site",
        "malicious url",
        "blacklist https",
        "domain",
        "screenshot",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "amazons3",
        "aes128gcm",
        "amazon rsa",
        "aes256",
        "date",
        "name verdict",
        "pattern match",
        "root ca",
        "script",
        "done adding",
        "catalog file",
        "file",
        "indicator",
        "authority",
        "class",
        "mitre att",
        "meta",
        "unknown",
        "error",
        "hybrid",
        "accept",
        "general",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "refresh",
        "tools",
        "null",
        "body",
        "create c",
        "html document",
        "xport",
        "noname057",
        "generic malware",
        "generic",
        "dapato",
        "alexa",
        "installcore",
        "downloader",
        "dropper",
        "outbreak",
        "iobit",
        "mediaget",
        "azorult",
        "runescape",
        "facebook",
        "bank",
        "download",
        "live",
        "rms",
        "maltiverse",
        "cyber threat",
        "engineering",
        "services",
        "malicious host",
        "malicious",
        "team",
        "zeus",
        "nymaim",
        "zbot",
        "simda",
        "asyncrat",
        "cobalt strike",
        "ransomware",
        "matsnu",
        "cutwail",
        "citadel",
        "pykspa",
        "raccoon",
        "kronos",
        "ramnit",
        "redline stealer",
        "apple",
        "apple",
        "html info",
        "title saal",
        "meta tags",
        "trackers google",
        "tag manager",
        "gtm5wjlq2",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "self",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "hostname",
        "anonymizer",
        "firehol",
        "mail spammer",
        "team proxy",
        "kraken",
        "suppobox",
        "tofsee",
        "vawtrak",
        "hotmail",
        "netsky",
        "stealer",
        "blacknet rat",
        "remcos",
        "miner",
        "hacktool",
        "trojan",
        "detplock",
        "team phishing",
        "a nxdomain",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "urls",
        "files",
        "ip address",
        "all search",
        "otx octoseek",
        "files ip",
        "contacted",
        "whois record",
        "ssl certificate",
        "pe resource",
        "bundled",
        "attack",
        "parent",
        "historical ssl",
        "collections",
        "communicating",
        "emotet",
        "execution",
        "markmonitor inc",
        "vhash",
        "authentihash",
        "imphash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "archive",
        "valid",
        "serial number",
        "valid from",
        "valid usage",
        "code signing",
        "status status",
        "valid issuer",
        "assured id",
        "issuer issuer",
        "symantec sha256",
        "sections",
        "file type",
        "trid generic",
        "cil executable",
        "contained",
        "details module",
        "version id",
        "typelib id",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "sections name",
        "streams size",
        "entropy chi2",
        "guid",
        "blob",
        "namecheap",
        "ip detections",
        "country",
        "resolutions",
        "referrer",
        "whois whois",
        "threat roundup",
        "parent domain",
        "CVE-2023-22518",
        "CVE-2017-0143",
        "CVE-2017-0147",
        "CVE-2020-0601",
        "CVE-2017-8570",
        "CVE-2018-4893",
        "CVE-2017-11882",
        "CVE-2017-0199",
        "CVE-2014-3153",
        "W32.AIDetectNet.01",
        "trojan.adload/ursu",
        "targeting tsara brashears",
        "cybercrime",
        "privilege escalation",
        "defacement",
        "privilege abuse",
        "soc",
        "red team",
        "social engineering",
        "retaliation",
        "assault victim",
        "obsession"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
        "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
        "\u2193 Interesting \u2193",
        "owa.telegrafix.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
        "christ.robert@gmx.de",
        "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
        "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
        "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
        "BEELab_web_1.0.2-prerelease.exe",
        "AfraidZad.exe",
        "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
        "greycroftpartners.com",
        "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
        "trkpls3.com",
        "eg-monitoring.com",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "https://twitter.com/PORNO_SEXYBABES"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Italy",
        "Singapore",
        "France",
        "Germany",
        "Korea, Republic of"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "RMS",
          "display_name": "RMS",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 83,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 841,
        "FileHash-SHA1": 467,
        "FileHash-SHA256": 6370,
        "CVE": 9,
        "domain": 2160,
        "hostname": 3074,
        "email": 1,
        "URL": 6550,
        "SSLCertFingerprint": 1,
        "CIDR": 3
      },
      "indicator_count": 19476,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a9b81da64500aa609122",
      "name": "APPLE CVE",
      "description": "",
      "modified": "2023-12-06T17:04:56.966000",
      "created": "2023-12-06T17:04:56.966000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 705,
        "FileHash-MD5": 171,
        "domain": 242,
        "hostname": 361,
        "URL": 496,
        "email": 3,
        "FileHash-SHA1": 123,
        "CVE": 1,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 2106,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 114,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6556878669ae5d5aa6b1a61f",
      "name": "APPLE CVE",
      "description": "",
      "modified": "2023-11-16T21:20:06.454000",
      "created": "2023-11-16T21:20:06.454000",
      "tags": [
        "scan endpoints",
        "all cve",
        "ellenmmm cve",
        "pulse pulses",
        "files",
        "exploits",
        "targeted",
        "cve overview",
        "ventura",
        "creation date",
        "impact"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "652e0a354e1ed460e652842c",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "URL": 523,
        "domain": 263,
        "hostname": 460,
        "FileHash-SHA256": 1269,
        "FileHash-MD5": 385,
        "FileHash-SHA1": 329,
        "SSLCertFingerprint": 4,
        "email": 3
      },
      "indicator_count": 3237,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "884 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "652e0a354e1ed460e652842c",
      "name": "APPLE CVE",
      "description": "Apple has fixed a bug in its operating system that may cause files to be infected with malware and then be opened and downloaded without a quarantine flag being put on the file, as well as a security check.",
      "modified": "2023-11-16T16:02:38.424000",
      "created": "2023-10-17T04:14:45.289000",
      "tags": [
        "scan endpoints",
        "all cve",
        "ellenmmm cve",
        "pulse pulses",
        "files",
        "exploits",
        "targeted",
        "cve overview",
        "ventura",
        "creation date",
        "impact"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ellenmmm",
        "id": "233693",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "URL": 523,
        "domain": 263,
        "hostname": 460,
        "FileHash-SHA256": 1269,
        "FileHash-MD5": 385,
        "FileHash-SHA1": 329,
        "SSLCertFingerprint": 4,
        "email": 3
      },
      "indicator_count": 3237,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 86,
      "modified_text": "885 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://test.jmtstudios.org",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://test.jmtstudios.org",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776622096.3063285
}