{
  "type": "URL",
  "indicator": "https://uss3.aosomcdn.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://uss3.aosomcdn.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3739904143,
      "indicator": "https://uss3.aosomcdn.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "68abf66e97031d0ff0c04fed",
          "name": "Packed sentient.industries links to a targets business website",
          "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
          "modified": "2025-09-24T04:04:05.604000",
          "created": "2025-08-25T05:36:46.327000",
          "tags": [
            "moved",
            "body",
            "x cache",
            "cloudfront x",
            "cph50 c2",
            "certificate",
            "record value",
            "title",
            "h1 center",
            "server",
            "redacted for",
            "servers",
            "name redacted",
            "for privacy",
            "name servers",
            "org data",
            "privacy city",
            "privacy country",
            "ca creation",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "asn as57033",
            "less whois",
            "registrar",
            "tucows domains",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl ecc",
            "domain secure",
            "site ca",
            "validity",
            "subject public",
            "extraction",
            "data upload",
            "extra data",
            "include review",
            "find",
            "failed",
            "typ no",
            "ms windows",
            "intel",
            "pe32",
            "united",
            "search",
            "as16509",
            "from win32bios",
            "show",
            "high",
            "medium",
            "delphi",
            "copy",
            "write",
            "launcher",
            "next",
            "present aug",
            "present jul",
            "lowfi",
            "win32",
            "a div",
            "div div",
            "learn xml",
            "babylon",
            "win64",
            "trojan",
            "colors",
            "python",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "et info",
            "tls handshake",
            "bad traffic",
            "failure",
            "date",
            "august",
            "hybrid",
            "general",
            "path",
            "starfield",
            "click",
            "strings",
            "se bethseda",
            "n bethseda",
            "n data",
            "error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results aug",
            "read c",
            "tlsv1",
            "port",
            "destination",
            "module load",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "cname",
            "aaaa",
            "creation date",
            "showing",
            "domain",
            "dga domains",
            "palantirfoundry",
            "foundry",
            "status",
            "unknown ns",
            "g2 tls",
            "rsa sha256",
            "italy unknown",
            "mtb may",
            "trojandropper",
            "invalid url",
            "next associated",
            "ddos",
            "body html",
            "hacktool",
            "ipv4",
            "url analysis",
            "ukraine",
            "encrypt",
            "rl add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present jun",
            "entries",
            "title error",
            "all ipv4",
            "reverse dns",
            "yara detections",
            "top source",
            "top destination",
            "source source",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "canada unknown",
            "content type",
            "javascript src",
            "script script",
            "x powered",
            "ipv4 add",
            "pulse submit",
            "submit url",
            "analysis",
            "url add",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "unknown aaaa",
            "ascii text",
            "user agent",
            "powershell",
            "agent",
            "czechia unknown",
            "domain add",
            "dynamicloader",
            "hostname add",
            "pentagon",
            "defense"
          ],
          "references": [
            "sentient.industries affects independent artists. Affects several others.",
            "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
            "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
            "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
            "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
            "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
            "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
            "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
            "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
            "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
            "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
            "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
            "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
            "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
            "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
            "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
            "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
            "https://link.monetizer101.com/widget/code/dailystaruk.js",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
            "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
            "(Can't access file- Malware infection files)",
            "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
            "constellation.pcfrpegaservice.net (Pegasus related? idk)",
            "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
            "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
            "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
            "Remotewd.com devices",
            "If you find anything interesting please research it."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "nUFS_inno",
              "display_name": "nUFS_inno",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious",
              "target": null
            },
            {
              "id": "ALF:JASYP:PUA:Win32/Bibado",
              "display_name": "ALF:JASYP:PUA:Win32/Bibado",
              "target": null
            },
            {
              "id": "Trojan:Win32/Toga",
              "display_name": "Trojan:Win32/Toga",
              "target": "/malware/Trojan:Win32/Toga"
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-149",
              "display_name": "Win.Trojan.Jorik-149",
              "target": null
            },
            {
              "id": "#LowFiDetectsVmWare",
              "display_name": "#LowFiDetectsVmWare",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-130",
              "display_name": "Win.Trojan.Jorik-130",
              "target": null
            },
            {
              "id": "Win.Trojan.Fakecodecs-119",
              "display_name": "Win.Trojan.Fakecodecs-119",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Bulz-9860169-0",
              "display_name": "Win.Trojan.Bulz-9860169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Midie-6847892-0",
              "display_name": "Win.Malware.Midie-6847892-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Muldrop.V!MTB",
              "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
              "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Win.Packed.Razy-9785185-0",
              "display_name": "Win.Packed.Razy-9785185-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "PWS",
              "display_name": "PWS",
              "target": null
            },
            {
              "id": "DDOS:Win32/Stormser.A",
              "display_name": "DDOS:Win32/Stormser.A",
              "target": "/malware/DDOS:Win32/Stormser.A"
            },
            {
              "id": "ALF:HSTR:DotNET",
              "display_name": "ALF:HSTR:DotNET",
              "target": null
            },
            {
              "id": "DotNET",
              "display_name": "DotNET",
              "target": null
            },
            {
              "id": "Script Exploit",
              "display_name": "Script Exploit",
              "target": null
            },
            {
              "id": "HackTool:Win32/AutoKMS",
              "display_name": "HackTool:Win32/AutoKMS",
              "target": "/malware/HackTool:Win32/AutoKMS"
            },
            {
              "id": "Xanfpezes.A",
              "display_name": "Xanfpezes.A",
              "target": null
            },
            {
              "id": "Trojan:Win32/Gandcrab",
              "display_name": "Trojan:Win32/Gandcrab",
              "target": "/malware/Trojan:Win32/Gandcrab"
            },
            {
              "id": "Win.Trojan.Generic-9862772-0",
              "display_name": "Win.Trojan.Generic-9862772-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zbot.SIBL!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
            },
            {
              "id": "Win32/Nemucod",
              "display_name": "Win32/Nemucod",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "target": null
            },
            {
              "id": "Trojan:Win32/Blihan.A",
              "display_name": "Trojan:Win32/Blihan.A",
              "target": "/malware/Trojan:Win32/Blihan.A"
            },
            {
              "id": "TrojanDropper:Win32/Muldrop",
              "display_name": "TrojanDropper:Win32/Muldrop",
              "target": "/malware/TrojanDropper:Win32/Muldrop"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            },
            {
              "id": "Win.Malware.Kolab-9885903-0",
              "display_name": "Win.Malware.Kolab-9885903-0",
              "target": null
            },
            {
              "id": "Win.Malware (30)",
              "display_name": "Win.Malware (30)",
              "target": null
            },
            {
              "id": "Ransom",
              "display_name": "Ransom",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "target": null
            },
            {
              "id": "E5",
              "display_name": "E5",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003.008",
              "name": "/etc/passwd and /etc/shadow",
              "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 6232,
            "URL": 24908,
            "hostname": 7993,
            "FileHash-SHA256": 11128,
            "email": 6,
            "FileHash-MD5": 1054,
            "FileHash-SHA1": 932,
            "SSLCertFingerprint": 14,
            "CIDR": 3,
            "CVE": 3
          },
          "indicator_count": 52273,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "207 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b8fe985a7460e0ee01be8a",
          "name": "r3.o.lencr.org",
          "description": "",
          "modified": "2024-08-11T18:14:13.378000",
          "created": "2024-08-11T18:10:32.276000",
          "tags": [
            "as20940",
            "united",
            "trojan",
            "search",
            "passive dns",
            "urls",
            "entries",
            "dashboard",
            "browse scan",
            "endpoints all",
            "date",
            "a domains",
            "aaaa",
            "record value",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "domain related",
            "showing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "64dc045f5344129c48c41826",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 664,
            "email": 13,
            "hostname": 1352,
            "FileHash-SHA256": 2550,
            "URL": 5422,
            "FileHash-MD5": 761,
            "FileHash-SHA1": 615
          },
          "indicator_count": 11377,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "616 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654136b5eb9bdd21070ff9d7",
          "name": "Cyber Espionage",
          "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:17:41.263000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "tsara brashears",
            "adult content",
            "pornography",
            "malvertizing",
            "privacy invasion",
            "privilege escalation",
            "packed",
            "aig.com",
            "aig.rastreator.mx",
            "apple",
            "ios",
            "tracking",
            "monitoring",
            "nr-data.net",
            "asp.net"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            }
          ],
          "industries": [
            "Defense",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 70,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5806,
            "URL": 16475,
            "domain": 3302,
            "hostname": 5135,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 31033,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654136c1ac991f85328604d2",
          "name": "Cyber Espionage",
          "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:17:52.382000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "tsara brashears",
            "adult content",
            "pornography",
            "malvertizing",
            "privacy invasion",
            "privilege escalation",
            "packed",
            "aig.com",
            "aig.rastreator.mx",
            "apple",
            "ios",
            "tracking",
            "monitoring",
            "nr-data.net",
            "asp.net"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            }
          ],
          "industries": [
            "Defense",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 69,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5806,
            "URL": 16475,
            "domain": 3302,
            "hostname": 5135,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 31033,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654136c8e530066ae793dc64",
          "name": "Cyber Espionage",
          "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:18:00.623000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "tsara brashears",
            "adult content",
            "pornography",
            "malvertizing",
            "privacy invasion",
            "privilege escalation",
            "packed",
            "aig.com",
            "aig.rastreator.mx",
            "apple",
            "ios",
            "tracking",
            "monitoring",
            "nr-data.net",
            "asp.net"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            }
          ],
          "industries": [
            "Defense",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 69,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5806,
            "URL": 16475,
            "domain": 3302,
            "hostname": 5135,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 31033,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65413ea960cc79abf6d446fb",
          "name": "Vawtrak credential stealer | CNC",
          "description": "Cyber warfare\nTracking\nMonitoring\nMalvertizing\nCNC\nKeylogging\nBotNet\nSever Privacy Invasion",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:51:37.016000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "keylogger",
            "sample path",
            "Miles IT"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 74,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5688,
            "URL": 15015,
            "domain": 3262,
            "hostname": 4687,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 28967,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6545be6e02e0f9f82cb1febf",
          "name": "Vawtrak credential stealer | CNC",
          "description": "",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-11-04T03:45:50.234000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "keylogger",
            "sample path",
            "Miles IT"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65413ea960cc79abf6d446fb",
          "export_count": 86,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5688,
            "URL": 15015,
            "domain": 3262,
            "hostname": 4687,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 28967,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "64dc045f5344129c48c41826",
          "name": "r3.o.lencr.org",
          "description": "Malware. R3.o.lencr.org is a browser-redirecting app aka browser hijacking, that attaches itself to main browser in devices. Ability to take control over some settings. Tracker. Scammers use Lencr.org/ LetsEncrypt in websites that have  malicious content and activities. \nMalicious Activity:\nALF:Trojan:Win32/Cassini_f9070846!ibt\nALFPER:CERT:SoftwareBundler:Win32/InstallMonetizer\nTrojan:Win32/Dorv.A!rfn\nTrojan:Win32/Prepscram\nTrojan:Win32/Zbot.SIBG!MTB\nTrojanDownloader:Win32/Banload\nTrojanDownloader:Win32/Upatre.D\nTrojanDownloader:Win32/Upatre.J\nWin.Downloader.Mailru-9797354-1\nWin.Dropper.Agent-185636\nRiskware\nMalicious Adware spamming \n\n(Auto Generated Description: A complete list of malicious files has been published on the website of Cloudflare.com, the company that provides access to the service for users who use its services to access their email addresses.)",
          "modified": "2023-09-15T04:05:29.096000",
          "created": "2023-08-15T23:03:59.403000",
          "tags": [
            "as20940",
            "united",
            "trojan",
            "search",
            "passive dns",
            "urls",
            "entries",
            "dashboard",
            "browse scan",
            "endpoints all",
            "date",
            "a domains",
            "aaaa",
            "record value",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "domain related",
            "showing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 664,
            "email": 13,
            "hostname": 1352,
            "FileHash-SHA256": 1750,
            "URL": 5422,
            "FileHash-MD5": 207,
            "FileHash-SHA1": 61
          },
          "indicator_count": 9469,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "947 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "Remotewd.com devices",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "sentient.industries affects independent artists. Affects several others.",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "If you find anything interesting please research it.",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "(Can't access file- Malware infection files)",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.trojan.jorik-149",
            "Nufs_inno",
            "Trojan:win32/zombie.a",
            "Xanfpezes.a",
            "#lowfi:hstr:msil/malicious",
            "#lowfienabledtcontinueafterunpacking",
            "Alf:hstr:dotnet",
            "Alf:jasyp:pua:win32/bibado",
            "Win.malware.kolab-9885903-0",
            "Pws",
            "Mydoom",
            "Win32/nemucod",
            "Script exploit",
            "Win32:downloader-gjk\\ [trj]",
            "Trojan:win32/blihan.a",
            "Win.downloader.109205-1",
            "Ddos:win32/stormser.a",
            "Trojandropper:win32/muldrop",
            "Win.trojan.jorik-130",
            "Hacktool:win32/autokms",
            "Win.trojan.bulz-9860169-0",
            "Win.malware (30)",
            "#lowfidetectsvmware",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "Custom malware",
            "Trojan:win32/zbot.sibl!mtb",
            "Trojan:win32/glupteba.mt!mtb",
            "E5",
            "Trojan:win32/toga",
            "#lowfi:hstr:msil/malicious.decryption",
            "Trojandropper:win32/muldrop.v!mtb",
            "Ransom",
            "Win.packed.razy-9785185-0",
            "Win.malware.midie-6847892-0",
            "Alf:heraklezeval:trojandownloader:html/adodb!rfn",
            "Win.trojan.generic-9862772-0",
            "Dotnet",
            "Trojan:win32/gandcrab",
            "Win.trojan.fakecodecs-119"
          ],
          "industries": [
            "Defense",
            "Government"
          ],
          "unique_indicators": 90436
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/aosomcdn.com",
    "whois": "http://whois.domaintools.com/aosomcdn.com",
    "domain": "aosomcdn.com",
    "hostname": "uss3.aosomcdn.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "68abf66e97031d0ff0c04fed",
      "name": "Packed sentient.industries links to a targets business website",
      "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
      "modified": "2025-09-24T04:04:05.604000",
      "created": "2025-08-25T05:36:46.327000",
      "tags": [
        "moved",
        "body",
        "x cache",
        "cloudfront x",
        "cph50 c2",
        "certificate",
        "record value",
        "title",
        "h1 center",
        "server",
        "redacted for",
        "servers",
        "name redacted",
        "for privacy",
        "name servers",
        "org data",
        "privacy city",
        "privacy country",
        "ca creation",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "asn as57033",
        "less whois",
        "registrar",
        "tucows domains",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl ecc",
        "domain secure",
        "site ca",
        "validity",
        "subject public",
        "extraction",
        "data upload",
        "extra data",
        "include review",
        "find",
        "failed",
        "typ no",
        "ms windows",
        "intel",
        "pe32",
        "united",
        "search",
        "as16509",
        "from win32bios",
        "show",
        "high",
        "medium",
        "delphi",
        "copy",
        "write",
        "launcher",
        "next",
        "present aug",
        "present jul",
        "lowfi",
        "win32",
        "a div",
        "div div",
        "learn xml",
        "babylon",
        "win64",
        "trojan",
        "colors",
        "python",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "et info",
        "tls handshake",
        "bad traffic",
        "failure",
        "date",
        "august",
        "hybrid",
        "general",
        "path",
        "starfield",
        "click",
        "strings",
        "se bethseda",
        "n bethseda",
        "n data",
        "error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results aug",
        "read c",
        "tlsv1",
        "port",
        "destination",
        "module load",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "cname",
        "aaaa",
        "creation date",
        "showing",
        "domain",
        "dga domains",
        "palantirfoundry",
        "foundry",
        "status",
        "unknown ns",
        "g2 tls",
        "rsa sha256",
        "italy unknown",
        "mtb may",
        "trojandropper",
        "invalid url",
        "next associated",
        "ddos",
        "body html",
        "hacktool",
        "ipv4",
        "url analysis",
        "ukraine",
        "encrypt",
        "rl add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present jun",
        "entries",
        "title error",
        "all ipv4",
        "reverse dns",
        "yara detections",
        "top source",
        "top destination",
        "source source",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "canada unknown",
        "content type",
        "javascript src",
        "script script",
        "x powered",
        "ipv4 add",
        "pulse submit",
        "submit url",
        "analysis",
        "url add",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "unknown aaaa",
        "ascii text",
        "user agent",
        "powershell",
        "agent",
        "czechia unknown",
        "domain add",
        "dynamicloader",
        "hostname add",
        "pentagon",
        "defense"
      ],
      "references": [
        "sentient.industries affects independent artists. Affects several others.",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "(Can't access file- Malware infection files)",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "Remotewd.com devices",
        "If you find anything interesting please research it."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "nUFS_inno",
          "display_name": "nUFS_inno",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious",
          "target": null
        },
        {
          "id": "ALF:JASYP:PUA:Win32/Bibado",
          "display_name": "ALF:JASYP:PUA:Win32/Bibado",
          "target": null
        },
        {
          "id": "Trojan:Win32/Toga",
          "display_name": "Trojan:Win32/Toga",
          "target": "/malware/Trojan:Win32/Toga"
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Custom Malware",
          "display_name": "Custom Malware",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-149",
          "display_name": "Win.Trojan.Jorik-149",
          "target": null
        },
        {
          "id": "#LowFiDetectsVmWare",
          "display_name": "#LowFiDetectsVmWare",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-130",
          "display_name": "Win.Trojan.Jorik-130",
          "target": null
        },
        {
          "id": "Win.Trojan.Fakecodecs-119",
          "display_name": "Win.Trojan.Fakecodecs-119",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Bulz-9860169-0",
          "display_name": "Win.Trojan.Bulz-9860169-0",
          "target": null
        },
        {
          "id": "Win.Malware.Midie-6847892-0",
          "display_name": "Win.Malware.Midie-6847892-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Muldrop.V!MTB",
          "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
          "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Win.Packed.Razy-9785185-0",
          "display_name": "Win.Packed.Razy-9785185-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "PWS",
          "display_name": "PWS",
          "target": null
        },
        {
          "id": "DDOS:Win32/Stormser.A",
          "display_name": "DDOS:Win32/Stormser.A",
          "target": "/malware/DDOS:Win32/Stormser.A"
        },
        {
          "id": "ALF:HSTR:DotNET",
          "display_name": "ALF:HSTR:DotNET",
          "target": null
        },
        {
          "id": "DotNET",
          "display_name": "DotNET",
          "target": null
        },
        {
          "id": "Script Exploit",
          "display_name": "Script Exploit",
          "target": null
        },
        {
          "id": "HackTool:Win32/AutoKMS",
          "display_name": "HackTool:Win32/AutoKMS",
          "target": "/malware/HackTool:Win32/AutoKMS"
        },
        {
          "id": "Xanfpezes.A",
          "display_name": "Xanfpezes.A",
          "target": null
        },
        {
          "id": "Trojan:Win32/Gandcrab",
          "display_name": "Trojan:Win32/Gandcrab",
          "target": "/malware/Trojan:Win32/Gandcrab"
        },
        {
          "id": "Win.Trojan.Generic-9862772-0",
          "display_name": "Win.Trojan.Generic-9862772-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zbot.SIBL!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
        },
        {
          "id": "Win32/Nemucod",
          "display_name": "Win32/Nemucod",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "target": null
        },
        {
          "id": "Trojan:Win32/Blihan.A",
          "display_name": "Trojan:Win32/Blihan.A",
          "target": "/malware/Trojan:Win32/Blihan.A"
        },
        {
          "id": "TrojanDropper:Win32/Muldrop",
          "display_name": "TrojanDropper:Win32/Muldrop",
          "target": "/malware/TrojanDropper:Win32/Muldrop"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        },
        {
          "id": "Win.Malware.Kolab-9885903-0",
          "display_name": "Win.Malware.Kolab-9885903-0",
          "target": null
        },
        {
          "id": "Win.Malware (30)",
          "display_name": "Win.Malware (30)",
          "target": null
        },
        {
          "id": "Ransom",
          "display_name": "Ransom",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "target": null
        },
        {
          "id": "E5",
          "display_name": "E5",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003.008",
          "name": "/etc/passwd and /etc/shadow",
          "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 6232,
        "URL": 24908,
        "hostname": 7993,
        "FileHash-SHA256": 11128,
        "email": 6,
        "FileHash-MD5": 1054,
        "FileHash-SHA1": 932,
        "SSLCertFingerprint": 14,
        "CIDR": 3,
        "CVE": 3
      },
      "indicator_count": 52273,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "207 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66b8fe985a7460e0ee01be8a",
      "name": "r3.o.lencr.org",
      "description": "",
      "modified": "2024-08-11T18:14:13.378000",
      "created": "2024-08-11T18:10:32.276000",
      "tags": [
        "as20940",
        "united",
        "trojan",
        "search",
        "passive dns",
        "urls",
        "entries",
        "dashboard",
        "browse scan",
        "endpoints all",
        "date",
        "a domains",
        "aaaa",
        "record value",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "domain related",
        "showing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "64dc045f5344129c48c41826",
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 664,
        "email": 13,
        "hostname": 1352,
        "FileHash-SHA256": 2550,
        "URL": 5422,
        "FileHash-MD5": 761,
        "FileHash-SHA1": 615
      },
      "indicator_count": 11377,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "616 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "654136b5eb9bdd21070ff9d7",
      "name": "Cyber Espionage",
      "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
      "modified": "2023-11-30T07:01:37.424000",
      "created": "2023-10-31T17:17:41.263000",
      "tags": [
        "contacted",
        "resolutions",
        "origin1",
        "ip address",
        "list",
        "communicating",
        "cyber threat",
        "united",
        "phishing",
        "phishing site",
        "covid19",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "detection list",
        "installcore",
        "nymaim",
        "suppobox",
        "malicious",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "malware site",
        "malicious site",
        "heur",
        "exploit",
        "alexa",
        "riskware",
        "team",
        "blacklist https",
        "blacklist",
        "facebook",
        "engineering",
        "iframe",
        "downloader",
        "unsafe",
        "artemis",
        "trojanx",
        "agent",
        "unruy",
        "win64",
        "fakealert",
        "fusioncore",
        "redirector",
        "killav",
        "trojan",
        "lokibot",
        "emotet",
        "redline stealer",
        "cobalt strike",
        "citadel",
        "vawtrak",
        "qakbot",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "adwind",
        "crack",
        "generic",
        "wacatac",
        "opencandy",
        "nircmd",
        "downldr",
        "filetour",
        "cleaner",
        "conduit",
        "tiggre",
        "presenoker",
        "zpevdo",
        "webcompanion",
        "seraph",
        "tofsee",
        "xrat",
        "xtrat",
        "patcher",
        "adload",
        "stealer",
        "vidar",
        "raccoon",
        "bank",
        "urls",
        "generic malware",
        "noname057",
        "reimer",
        "agency",
        "charles",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "name verdict",
        "date",
        "root ca",
        "markmonitor",
        "name server",
        "windir",
        "unknown",
        "swisscom root",
        "post root",
        "trust",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "defence",
        "fraud",
        "logistics",
        "ipv4",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "report spam",
        "author",
        "cyber warfare",
        "created",
        "months ago",
        "modified",
        "next",
        "url https",
        "url http",
        "all octoseek",
        "month ago",
        "utmsourcemailer",
        "ck id",
        "t1140",
        "filehashsha256",
        "tsara brashears",
        "adult content",
        "pornography",
        "malvertizing",
        "privacy invasion",
        "privilege escalation",
        "packed",
        "aig.com",
        "aig.rastreator.mx",
        "apple",
        "ios",
        "tracking",
        "monitoring",
        "nr-data.net",
        "asp.net"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        }
      ],
      "industries": [
        "Defense",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 70,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 166,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 5806,
        "URL": 16475,
        "domain": 3302,
        "hostname": 5135,
        "CVE": 16,
        "email": 8
      },
      "indicator_count": 31033,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "871 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "654136c1ac991f85328604d2",
      "name": "Cyber Espionage",
      "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
      "modified": "2023-11-30T07:01:37.424000",
      "created": "2023-10-31T17:17:52.382000",
      "tags": [
        "contacted",
        "resolutions",
        "origin1",
        "ip address",
        "list",
        "communicating",
        "cyber threat",
        "united",
        "phishing",
        "phishing site",
        "covid19",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "detection list",
        "installcore",
        "nymaim",
        "suppobox",
        "malicious",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "malware site",
        "malicious site",
        "heur",
        "exploit",
        "alexa",
        "riskware",
        "team",
        "blacklist https",
        "blacklist",
        "facebook",
        "engineering",
        "iframe",
        "downloader",
        "unsafe",
        "artemis",
        "trojanx",
        "agent",
        "unruy",
        "win64",
        "fakealert",
        "fusioncore",
        "redirector",
        "killav",
        "trojan",
        "lokibot",
        "emotet",
        "redline stealer",
        "cobalt strike",
        "citadel",
        "vawtrak",
        "qakbot",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "adwind",
        "crack",
        "generic",
        "wacatac",
        "opencandy",
        "nircmd",
        "downldr",
        "filetour",
        "cleaner",
        "conduit",
        "tiggre",
        "presenoker",
        "zpevdo",
        "webcompanion",
        "seraph",
        "tofsee",
        "xrat",
        "xtrat",
        "patcher",
        "adload",
        "stealer",
        "vidar",
        "raccoon",
        "bank",
        "urls",
        "generic malware",
        "noname057",
        "reimer",
        "agency",
        "charles",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "name verdict",
        "date",
        "root ca",
        "markmonitor",
        "name server",
        "windir",
        "unknown",
        "swisscom root",
        "post root",
        "trust",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "defence",
        "fraud",
        "logistics",
        "ipv4",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "report spam",
        "author",
        "cyber warfare",
        "created",
        "months ago",
        "modified",
        "next",
        "url https",
        "url http",
        "all octoseek",
        "month ago",
        "utmsourcemailer",
        "ck id",
        "t1140",
        "filehashsha256",
        "tsara brashears",
        "adult content",
        "pornography",
        "malvertizing",
        "privacy invasion",
        "privilege escalation",
        "packed",
        "aig.com",
        "aig.rastreator.mx",
        "apple",
        "ios",
        "tracking",
        "monitoring",
        "nr-data.net",
        "asp.net"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        }
      ],
      "industries": [
        "Defense",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 69,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 166,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 5806,
        "URL": 16475,
        "domain": 3302,
        "hostname": 5135,
        "CVE": 16,
        "email": 8
      },
      "indicator_count": 31033,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "871 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "654136c8e530066ae793dc64",
      "name": "Cyber Espionage",
      "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
      "modified": "2023-11-30T07:01:37.424000",
      "created": "2023-10-31T17:18:00.623000",
      "tags": [
        "contacted",
        "resolutions",
        "origin1",
        "ip address",
        "list",
        "communicating",
        "cyber threat",
        "united",
        "phishing",
        "phishing site",
        "covid19",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "detection list",
        "installcore",
        "nymaim",
        "suppobox",
        "malicious",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "malware site",
        "malicious site",
        "heur",
        "exploit",
        "alexa",
        "riskware",
        "team",
        "blacklist https",
        "blacklist",
        "facebook",
        "engineering",
        "iframe",
        "downloader",
        "unsafe",
        "artemis",
        "trojanx",
        "agent",
        "unruy",
        "win64",
        "fakealert",
        "fusioncore",
        "redirector",
        "killav",
        "trojan",
        "lokibot",
        "emotet",
        "redline stealer",
        "cobalt strike",
        "citadel",
        "vawtrak",
        "qakbot",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "adwind",
        "crack",
        "generic",
        "wacatac",
        "opencandy",
        "nircmd",
        "downldr",
        "filetour",
        "cleaner",
        "conduit",
        "tiggre",
        "presenoker",
        "zpevdo",
        "webcompanion",
        "seraph",
        "tofsee",
        "xrat",
        "xtrat",
        "patcher",
        "adload",
        "stealer",
        "vidar",
        "raccoon",
        "bank",
        "urls",
        "generic malware",
        "noname057",
        "reimer",
        "agency",
        "charles",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "name verdict",
        "date",
        "root ca",
        "markmonitor",
        "name server",
        "windir",
        "unknown",
        "swisscom root",
        "post root",
        "trust",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "defence",
        "fraud",
        "logistics",
        "ipv4",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "report spam",
        "author",
        "cyber warfare",
        "created",
        "months ago",
        "modified",
        "next",
        "url https",
        "url http",
        "all octoseek",
        "month ago",
        "utmsourcemailer",
        "ck id",
        "t1140",
        "filehashsha256",
        "tsara brashears",
        "adult content",
        "pornography",
        "malvertizing",
        "privacy invasion",
        "privilege escalation",
        "packed",
        "aig.com",
        "aig.rastreator.mx",
        "apple",
        "ios",
        "tracking",
        "monitoring",
        "nr-data.net",
        "asp.net"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        }
      ],
      "industries": [
        "Defense",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 69,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 166,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 5806,
        "URL": 16475,
        "domain": 3302,
        "hostname": 5135,
        "CVE": 16,
        "email": 8
      },
      "indicator_count": 31033,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "871 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65413ea960cc79abf6d446fb",
      "name": "Vawtrak credential stealer | CNC",
      "description": "Cyber warfare\nTracking\nMonitoring\nMalvertizing\nCNC\nKeylogging\nBotNet\nSever Privacy Invasion",
      "modified": "2023-11-30T07:01:37.424000",
      "created": "2023-10-31T17:51:37.016000",
      "tags": [
        "contacted",
        "resolutions",
        "origin1",
        "ip address",
        "list",
        "communicating",
        "cyber threat",
        "united",
        "phishing",
        "phishing site",
        "covid19",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "detection list",
        "installcore",
        "nymaim",
        "suppobox",
        "malicious",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "malware site",
        "malicious site",
        "heur",
        "exploit",
        "alexa",
        "riskware",
        "team",
        "blacklist https",
        "blacklist",
        "facebook",
        "engineering",
        "iframe",
        "downloader",
        "unsafe",
        "artemis",
        "trojanx",
        "agent",
        "unruy",
        "win64",
        "fakealert",
        "fusioncore",
        "redirector",
        "killav",
        "trojan",
        "lokibot",
        "emotet",
        "redline stealer",
        "cobalt strike",
        "citadel",
        "vawtrak",
        "qakbot",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "adwind",
        "crack",
        "generic",
        "wacatac",
        "opencandy",
        "nircmd",
        "downldr",
        "filetour",
        "cleaner",
        "conduit",
        "tiggre",
        "presenoker",
        "zpevdo",
        "webcompanion",
        "seraph",
        "tofsee",
        "xrat",
        "xtrat",
        "patcher",
        "adload",
        "stealer",
        "vidar",
        "raccoon",
        "bank",
        "urls",
        "generic malware",
        "noname057",
        "reimer",
        "agency",
        "charles",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "name verdict",
        "date",
        "root ca",
        "markmonitor",
        "name server",
        "windir",
        "unknown",
        "swisscom root",
        "post root",
        "trust",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "defence",
        "fraud",
        "logistics",
        "ipv4",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "report spam",
        "author",
        "cyber warfare",
        "created",
        "months ago",
        "modified",
        "next",
        "url https",
        "url http",
        "all octoseek",
        "month ago",
        "utmsourcemailer",
        "ck id",
        "t1140",
        "filehashsha256",
        "keylogger",
        "sample path",
        "Miles IT"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 74,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 166,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 5688,
        "URL": 15015,
        "domain": 3262,
        "hostname": 4687,
        "CVE": 16,
        "email": 8
      },
      "indicator_count": 28967,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "871 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6545be6e02e0f9f82cb1febf",
      "name": "Vawtrak credential stealer | CNC",
      "description": "",
      "modified": "2023-11-30T07:01:37.424000",
      "created": "2023-11-04T03:45:50.234000",
      "tags": [
        "contacted",
        "resolutions",
        "origin1",
        "ip address",
        "list",
        "communicating",
        "cyber threat",
        "united",
        "phishing",
        "phishing site",
        "covid19",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "detection list",
        "installcore",
        "nymaim",
        "suppobox",
        "malicious",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "malware site",
        "malicious site",
        "heur",
        "exploit",
        "alexa",
        "riskware",
        "team",
        "blacklist https",
        "blacklist",
        "facebook",
        "engineering",
        "iframe",
        "downloader",
        "unsafe",
        "artemis",
        "trojanx",
        "agent",
        "unruy",
        "win64",
        "fakealert",
        "fusioncore",
        "redirector",
        "killav",
        "trojan",
        "lokibot",
        "emotet",
        "redline stealer",
        "cobalt strike",
        "citadel",
        "vawtrak",
        "qakbot",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "adwind",
        "crack",
        "generic",
        "wacatac",
        "opencandy",
        "nircmd",
        "downldr",
        "filetour",
        "cleaner",
        "conduit",
        "tiggre",
        "presenoker",
        "zpevdo",
        "webcompanion",
        "seraph",
        "tofsee",
        "xrat",
        "xtrat",
        "patcher",
        "adload",
        "stealer",
        "vidar",
        "raccoon",
        "bank",
        "urls",
        "generic malware",
        "noname057",
        "reimer",
        "agency",
        "charles",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "name verdict",
        "date",
        "root ca",
        "markmonitor",
        "name server",
        "windir",
        "unknown",
        "swisscom root",
        "post root",
        "trust",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "defence",
        "fraud",
        "logistics",
        "ipv4",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "report spam",
        "author",
        "cyber warfare",
        "created",
        "months ago",
        "modified",
        "next",
        "url https",
        "url http",
        "all octoseek",
        "month ago",
        "utmsourcemailer",
        "ck id",
        "t1140",
        "filehashsha256",
        "keylogger",
        "sample path",
        "Miles IT"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65413ea960cc79abf6d446fb",
      "export_count": 86,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 166,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 5688,
        "URL": 15015,
        "domain": 3262,
        "hostname": 4687,
        "CVE": 16,
        "email": 8
      },
      "indicator_count": 28967,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "871 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "64dc045f5344129c48c41826",
      "name": "r3.o.lencr.org",
      "description": "Malware. R3.o.lencr.org is a browser-redirecting app aka browser hijacking, that attaches itself to main browser in devices. Ability to take control over some settings. Tracker. Scammers use Lencr.org/ LetsEncrypt in websites that have  malicious content and activities. \nMalicious Activity:\nALF:Trojan:Win32/Cassini_f9070846!ibt\nALFPER:CERT:SoftwareBundler:Win32/InstallMonetizer\nTrojan:Win32/Dorv.A!rfn\nTrojan:Win32/Prepscram\nTrojan:Win32/Zbot.SIBG!MTB\nTrojanDownloader:Win32/Banload\nTrojanDownloader:Win32/Upatre.D\nTrojanDownloader:Win32/Upatre.J\nWin.Downloader.Mailru-9797354-1\nWin.Dropper.Agent-185636\nRiskware\nMalicious Adware spamming \n\n(Auto Generated Description: A complete list of malicious files has been published on the website of Cloudflare.com, the company that provides access to the service for users who use its services to access their email addresses.)",
      "modified": "2023-09-15T04:05:29.096000",
      "created": "2023-08-15T23:03:59.403000",
      "tags": [
        "as20940",
        "united",
        "trojan",
        "search",
        "passive dns",
        "urls",
        "entries",
        "dashboard",
        "browse scan",
        "endpoints all",
        "date",
        "a domains",
        "aaaa",
        "record value",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "domain related",
        "showing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 664,
        "email": 13,
        "hostname": 1352,
        "FileHash-SHA256": 1750,
        "URL": 5422,
        "FileHash-MD5": 207,
        "FileHash-SHA1": 61
      },
      "indicator_count": 9469,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "947 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://uss3.aosomcdn.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://uss3.aosomcdn.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776622709.0957108
}